# Geek Guy > Everything is ideas, the rest is nature. Language: en URL: https://www.geek-guy.com/ All pages on this site are available as clean Markdown by adding the header `Accept: text/markdown` to any HTTP request, or via the REST API: REST API: https://www.geek-guy.com/wp-json/mescio-for-agents/v1/markdown?url={page_url} REST API (by id): https://www.geek-guy.com/wp-json/mescio-for-agents/v1/markdown?id={post_id} ## Pages - [Threat Actor Dossier: APT38 (Lazarus Group)](https://www.geek-guy.com/2026-threat-intel-report/threat-actor-dossier-apt38-lazarus-group/): THREAT ACTOR DOSSIER ==================== BASIC INFORMATION Name: APT38 (Lazarus Group)  Aliases: APT38, HIDDEN COBRA, DHARMA, DPRK THREAT ACTOR, NORTH KOREAN CYBER WARFARE, G0032  MITRE ATT&CK Group ID: G0032  Country of Origin: North Korea (DPRK)  Affiliation: North Korean state-sponsored cyber warfare unit  Type: State-sponsored cyber warfare - [Tokenization](https://www.geek-guy.com/glossary-of-sec-and-it-terms/tokenization/): Tokenization. Replacing sensitive data with non-sensitive tokens that have no value if stolen, commonly used in PCI-DSS compliance. - [Shadow AI](https://www.geek-guy.com/glossary-of-sec-and-it-terms/shadow-ai/): Shadow AI. The use of unapproved AI tools by employees, which risks the leakage of proprietary code or PII into public LLM training sets. - [DLP](https://www.geek-guy.com/glossary-of-sec-and-it-terms/dlp/): Data Loss Prevention is a set of tools that inspects data in use, in transit, and at rest to prevent unauthorized transmission of sensitive info. - [DDR](https://www.geek-guy.com/glossary-of-sec-and-it-terms/ddr/): Data Detection and Response provides real-time monitoring of data access and movement to stop exfiltration across Cloud and SaaS apps. - [Data Sovereignty](https://www.geek-guy.com/glossary-of-sec-and-it-terms/data-sovereignty/): Data Sovereignty. The principle that data is subject to the laws of the country where it is physically stored (e.g., GDPR requirements for data residency). - [AI-BOM](https://www.geek-guy.com/glossary-of-sec-and-it-terms/ai-bom/): An AI Bill of Materials (AIBOM) is a comprehensive, machine-readable inventory of the components required to develop, train, and run an AI model. It is the AI-specific evolution of the traditional Software Bill of Materials (SBOM). - [SBOM](https://www.geek-guy.com/glossary-of-sec-and-it-terms/sbom/): Software Bill of Materials is a machine-readable ingredient list for software, used to track vulnerabilities in open-source dependencies. - [Supply Chain Risk Management](https://www.geek-guy.com/supply-chain-risk-management/): Supply Chain Risk Management focuses on the security of third-party vendors, from hardware manufacturing (silicon root of trust) to software libraries. - [CIA Triad](https://www.geek-guy.com/glossary-of-sec-and-it-terms/cia-triad/): The CIA Triad (Confidentiality, Integrity, Availability), expanded to include Authenticity and Non-repudiation. - [Exposure Management](https://www.geek-guy.com/glossary-of-sec-and-it-terms/exposure-management/): Exposure Management. Is a shift from finding CVEs to analyzing the exploitability of an entire attack surface, including misconfigurations and risky behaviors. - [AI-SPM](https://www.geek-guy.com/glossary-of-sec-and-it-terms/ai-spm/): AI Security Posture Management secures the AI stack, detecting Shadow AI and protecting models from prompt injection or data poisoning. - [Zero Trust](https://www.geek-guy.com/glossary-of-sec-and-it-terms/zero-trust/): Zero Trust. An architecture based on the principle of never trust, always verify, removing the concept of a trusted internal network. - [TEE](https://www.geek-guy.com/glossary-of-sec-and-it-terms/tee/): Trusted Execution Environment is a secure enclave in a processor that protects data and code even if the host OS is compromised. - [Threat Actor Dossier: APT41 (BARIUM/BRASS TYPHOON/WICKED PANDA)](https://www.geek-guy.com/2026-threat-intel-report/threat-actor-dossier-apt41-barium-brass-typhoon-wicked-panda/): THREAT ACTOR DOSSIER ==================== BASIC INFORMATION Name: APT41 (Advanced Persistent Threat 41)  Aliases: BARIUM, BRASS TYPHOON, WICKED PANDA, Double Dragon  MITRE ATT&CK Group ID: G0096  Country of Origin: People's Republic of China  Affiliation: Chinese state-sponsored espionage group  Type: Dual-purpose (state-sponsored espionage + financially motivated cybercrime) - [2026 Threat Intel Report](https://www.geek-guy.com/2026-threat-intel-report/): THREAT ACTOR INTELLIGENCE REPORT Comprehensive Analysis of Major Threat Actors (2026) Classification: Unclassified - Intelligence gathered from open and public sources Executive Summary This report provides a comprehensive analysis of ALL major global threat actors, focusing on their recent operations, - [CyberSec Product Reviews](https://www.geek-guy.com/cybersecurity-product-reviews/): The ideal resource for cybersecurity professionals, Chief Information Security Officers and Security Operations professionals. -=-=-=- Coming Soon -=-=-=-= Cybersecurity Products by Category Cybersecurity Products (Alphabetically) Products by Category - [Shop](https://www.geek-guy.com/shop/) - [A Beginner’s Guide to Malware Detection](https://www.geek-guy.com/beginners-guide-to-malware-detection/): Discover essential insights on malware detection, learn to identify threats, and protect your devices with this beginner-friendly guide. - [Penetration Testing](https://www.geek-guy.com/glossary-of-sec-and-it-terms/penetration-testing/): Penetration Testing. A structured, authorized attempt to exploit vulnerabilities in a system to evaluate the security of that system. - [IAST](https://www.geek-guy.com/glossary-of-sec-and-it-terms/iast/): Interactive Application Security Testing uses agents inside the app to find vulnerabilities during runtime with high accuracy. - [Breach and Attack Simulation](https://www.geek-guy.com/glossary-of-sec-and-it-terms/breach-and-attack-simulation-2/): Breach and Attack Simulation tools that automate the execution of threat actor TTPs to continuously validate security controls. - [Breach and Attack Simulation](https://www.geek-guy.com/glossary-of-sec-and-it-terms/breach-and-attack-simulation/): Breach and Attack Simulation tools that automate the execution of threat actor TTPs to continuously validate security controls. - [Adversarial ML](https://www.geek-guy.com/glossary-of-sec-and-it-terms/adversarial-ml/): Adversarial ML. Testing AI models by attempting to trick them with adversarial inputs to bypass security filters or extract training data. - [Due Diligence](https://www.geek-guy.com/glossary-of-sec-and-it-terms/due-diligence/): The investigative process of verifying that the necessary Due Care is actually being implemented and remains effective over time. - [Due Care](https://www.geek-guy.com/glossary-of-sec-and-it-terms/due-care/): Due Care. The legal standard of reasonableness that an organization must meet to protect its assets and data; often described as what a prudent person would do. - [CTEM](https://www.geek-guy.com/glossary-of-sec-and-it-terms/ctem/): Continuous Threat Exposure Management is a 5-stage framework (Scoping, Discovery, Prioritization, Validation, Mobilization) that replaces static vulnerability scanning. - [Contact us](https://www.geek-guy.com/contact-us/): Contact the Geek Use this page to contact us. - [List of Top Regulations/Frameworks in Cybersecurity](https://www.geek-guy.com/level-up-your-security-game-with-geek-guy-resources/list-of-top-regulations-frameworks-in-cybersecurity/) - [Book: Managers Guide to Becoming Great – Graphics](https://www.geek-guy.com/about-geek-guy/managers-guide-to-becoming-great-graphics/): If you are interested in purchasing the book, it can be purchased on Amazon at "Managers Guide to becoming Great" If you are interested in purchasing the book, it can be purchased on Amazon at "Managers Guide to becoming Great" - [Malware Reversing](https://www.geek-guy.com/malware-reversing/): Here's a list of some of the best malware reversing tools from Geek-Guy.com: Based on the most complete archives of the Malware Reversing resource page from Geek-Guy.com, here are the extracted tools and their current, functional links organized by category: - [CISSP Domains and Guidance](https://www.geek-guy.com/level-up-your-security-game-with-geek-guy-resources/cissp-domains-and-guidance/): The ISC2 (International Information System Security Certification Consortium) has several certifications, each with its own domains of knowledge. To give you the most relevant information, I need to know which certification you're interested in. However, since the CISSP (Certified Information - [Glossary of Cybersecurity and Market Terms](https://www.geek-guy.com/glossary-of-sec-and-it-terms/): A comprehensive glossary explaining common cybersecurity and IT terms in simple language. Generative AI can easily compile and define such terms, making complex topics accessible to a wider audience. Glossary Traditional Security Concepts 2026 relevant terminology and structured strictly by - [Top ~100 Open Source Security Tools](https://www.geek-guy.com/top-100-open-source-security-tools/): 1. Network Discovery & Scanning Tool NameOfficial URLPurposeNmaphttps://nmap.org/Network exploration and security auditingZMaphttps://zmap.io/Fast internet-wide network scannerMasscanhttps://github.com/robertdavidgraham/masscanTCP port scanner, spews SYN packetsNetcat (ncat)https://nmap.org/ncat/The "Swiss-army knife" for TCP/IPScapyhttps://scapy.net/Packet manipulation and sniffing 2. Vulnerability Scanning & Management Tool NameOfficial URLPurposeOpenVAS (GVM)https://www.openvas.org/Full-featured vulnerability scannerNiktohttps://github.com/sullo/niktoWeb server - [Level Up Your Security Game with Geek-Guy Resources](https://www.geek-guy.com/level-up-your-security-game-with-geek-guy-resources/): Dive into our comprehensive collection of cybersecurity resources, designed to empower both seasoned professionals and curious newcomers. Explore a vast library of tools, knowledge, and community-driven insights. Resource Pages at Geek-Guy.com - [Largest Threat Intelligence (OSINT) MEGA LIST in the World](https://www.geek-guy.com/largest-threat-intelligence-osint-mega-list-in-the-world/): Below is the extracted list of OSINT and Threat Intelligence resources from that page, organized into a table with their respective categories and URLs. OSINT & Threat Intelligence Mega List Resource NameURLCategoryAbuse.chhttps://abuse.ch/Malware & Ransomware TrackerAbuseIPDBhttps://www.abuseipdb.com/IP Reputation & ReportingAlienVault OTXhttps://otx.alienvault.com/Open Threat - [Privacy Policy](https://www.geek-guy.com/privacy-policy-2/) - [Private Search Engine](https://www.geek-guy.com/private-search-engine/): Bookmark this Geek-Guy Search Engine: Search multiple search engines with proxied results. Search You can also go directly to the search engine by going to https://search.geek-guy.com - [Our Dev Projects](https://www.geek-guy.com/our-projects/):   Our Github https://github.com/lpingree Popular repositories Loading Virustotal-Netstat-lookup-Tool-for-Linux Public Virustotal netstat output lookup tool Python amy---Active-Malware-Yield Public Automated script to lookup virustotal hashes from running processes on linux. Python traceroutemap Public A tool to trace to all the main webs - [Top Topics](https://www.geek-guy.com/top-topics/) - [BCS](https://www.geek-guy.com/glossary-of-sec-and-it-terms/bcs/): Business Continuity Steering is the leadership committee that oversees the strategic alignment of recovery efforts with business objectives. - [Cybersecurity Culture and Music](https://www.geek-guy.com/cybersecurity-culture-and-music/): Here is the updated table with direct links to the songs or the albums where they are hosted. Most of the tracks come from their specialized AI-generated album, Sounds of Security, which is a fantastic resource for awareness training. Cybersecurity - [Domain 8: Software Development Security](https://www.geek-guy.com/level-up-your-security-game-with-geek-guy-resources/cissp-domains-and-guidance/domain-8-software-development-security/): Exam Weight: 10% Domain 8 focuses on integrating security into the Software Development Life Cycle (SDLC). As a security researcher and analyst, this domain likely resonates with your work in threat actor analysis and data security. The key takeaway for - [Domain 7: Security Operations](https://www.geek-guy.com/level-up-your-security-game-with-geek-guy-resources/cissp-domains-and-guidance/domain-7-security-operations/): Exam Weight: 13% Domain 7 is where "the rubber meets the road." It focuses on the day-to-day practicalities of running a security program, responding to incidents, and ensuring the business stays afloat during a disaster. It is heavily focused on - [Domain 6: Security Assessment and Testing](https://www.geek-guy.com/level-up-your-security-game-with-geek-guy-resources/cissp-domains-and-guidance/domain-6-security-assessment-and-testing/): Exam Weight: 12% Domain 6 is about verifying the truth. While other domains focus on building and operating security, this domain focuses on proving that those controls actually work. It bridges the gap between technical testing and management-level auditing. 1. - [Domain 5: Identity and Access Management (IAM)](https://www.geek-guy.com/level-up-your-security-game-with-geek-guy-resources/cissp-domains-and-guidance/domain-5-identity-and-access-management-iam/): Exam Weight: 13% Domain 5 focuses on the "Who" and "How" of access. It covers the systems used to identify, authenticate, and authorize users and devices. In the modern era of Zero Trust and Agentic Identity, this domain has become - [Domain 4: Communication and Network Security](https://www.geek-guy.com/level-up-your-security-game-with-geek-guy-resources/cissp-domains-and-guidance/domain-4-communication-and-network-security/): Exam Weight: 13% Domain 4 is the plumbing of the digital world. It focuses on the secure design and protection of network architectures, ensuring data remains confidential and available while moving across wires, airwaves, or fiber. 1. The OSI and - [Domain 3: Security Architecture and Engineering](https://www.geek-guy.com/level-up-your-security-game-with-geek-guy-resources/cissp-domains-and-guidance/domain-3-security-architecture-and-engineering/): Exam Weight: 13% Domain 3 is the most technical and broad domain. It covers everything from hardware architecture and the "Ring Model" to cryptography and physical site security. To master this domain, you must understand how secure systems are built - [Domain 2: Asset Security](https://www.geek-guy.com/level-up-your-security-game-with-geek-guy-resources/cissp-domains-and-guidance/domain-2-asset-security/): Exam Weight: 10% Domain 2 is often considered one of the easier domains, but its importance is massive because it defines what we are protecting. If you don't classify and inventory your assets correctly, your security controls in the other - [Domain 1: Security and Risk Management](https://www.geek-guy.com/level-up-your-security-game-with-geek-guy-resources/cissp-domains-and-guidance/domain-1-security-and-risk-management/): Exam Weight: 16% (Highest weighted domain) This domain serves as the brain of the CISSP. It focuses on how security supports the business through governance, risk analysis, and legal compliance. As a CISSP candidate, you must think like a manager: ## Blog Posts - [China-backed threat group used agentic AI pentesting tool to compromise 140 sensitive targets in 11 days](https://cyberscoop.com/china-vapor-panda-agentic-ai-artex-campaign-crowdstrike/) (2026-10-30): A China state-backed threat group is using ARTEX, the automated agentic AI penetration testing framework, to achieve remarkable speed, scale and success in a campaign that already compromised about 140 sensitive targets in 11 days, according to CrowdStrike.  The threat - [Yoba Malware Hides a Crypto Miner Behind Legitimate OpenAI and Anthropic Binaries](https://securityaffairs.com/202149/malware/yoba-malware-hides-a-crypto-miner-behind-legitimate-openai-and-anthropic-binaries.html) (2026-10-30): Yoba malware uses fake ChatGPT and Claude apps to sideload malware through signed installers and deploy a cryptocurrency miner. Check Point Research has spent two months tracking a campaign it calls Yoba, which uses the popularity of AI tools to - [Critical Linux kernel flaw allows remote root attacks on MPTCP servers](https://www.bleepingcomputer.com/news/security/critical-linux-kernel-flaw-allows-remote-root-attacks-on-mptcp-servers/) (2026-10-30): Security researchers at Anthropic have developed an exploit for a critical Linux kernel vulnerability that allows unauthenticated attackers to remotely execute commands as root on servers running Multipath TCP (MPTCP) listeners. - [Linux kernel exploit enables remote root attacks on MPTCP servers](https://www.bleepingcomputer.com/news/security/linux-kernel-exploit-enables-remote-root-attacks-on-mptcp-servers/) (2026-10-30): Security researchers at Anthropic have developed an exploit for a critical Linux kernel vulnerability that allows unauthenticated attackers to remotely execute commands as root on servers running Multipath TCP (MPTCP) listeners. - [U.S. CISA adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog](https://securityaffairs.com/202133/security/u-s-cisa-adds-gitlab-and-cisco-flaws-to-its-known-exploited-vulnerabilities-catalog.html) (2026-10-30): U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added GitLab and Cisco vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: Below are the flaws added to - [Devs Hit by Trojanized Claude Code Extension for Cursor](https://www.darkreading.com/cyberattacks-data-breaches/devs-trojanized-claude-code-extension-cursor) (2026-10-30): Two serious security issues hit Cursor on the same day, highlighting the risks for AI-powered integrated development environments (IDEs). - [$6.3 Billion Stolen from Binance in Attack Attributed to North Korea](https://securityaffairs.com/202119/cyber-crime/6-3-billion-stolen-from-binance-in-attack-attributed-to-north-korea.html) (2026-10-30): Binance links a $6.3 billion crypto theft to a compromised DevOps laptop, with North Korean hackers blamed by blockchain analysts. Binance was investigating suspicious transfers that early estimates put at up to $5.8 billion. A day later, multiple media outlets - [TeamViewer Vulnerability Lets Attackers Run Code on IT Support Staff’s PCs](https://hackread.com/teamviewer-vulnerability-code-it-support-staff-pcs/) (2026-10-30): A vulnerability in TeamViewer could let attackers run code on an IT support technician’s computer when the technician… - [Shield Benchmarks AI Models for IT Helpdesk Performance](https://www.channelinsider.com/ai/shield-ai-helpdesk-benchmarks-it-support/) (2026-10-30): Shield Technology Partners has released new AI benchmarks showing that even leading AI models struggle to consistently resolve complex IT support tickets, raising questions about how MSPs should balance automation with technician oversight. The evaluation tested leading AI models against - [Presidio Sees Cisco Updates Fueling Managed Services](https://www.channelinsider.com/channel-business/presidio-cisco-ai-managed-services-growth/) (2026-10-30): Cisco’s latest AI and infrastructure updates could create new opportunities for solution providers to expand recurring revenue through managed services, network modernization, and security operations, according to Presidio Chief Solutions Officer Dan O’Brien. Speaking with Channel Insider at Cisco Partner - [IT Distribution Earnings Show Strong Growth Across Channel](https://www.channelinsider.com/channel-business/it-distribution-earnings-2026-channel-growth/) (2026-10-30): TD SYNNEX, Ingram Micro and Westcon-Comstor have each reported double-digit sales growth in their latest earnings results, signaling continued strength in IT distribution as demand for AI infrastructure, cybersecurity, cloud and networking drives technology spending. The results highlight more than - [Anthropic Launches New Claude Tools to Measure AI Spending and Value](https://www.channelinsider.com/ai/news-anthropic-claude-enterprise-ai-spending-tools/) (2026-10-30): Anthropic wants businesses to stop guessing whether their AI investments are paying off, and its latest Claude Enterprise tools aim to give them a clearer picture of spending and results. The company has made three features generally available to Claude - [Android 17 adoption hits a staggering 1% – why you really should update now](https://www.zdnet.com/tech/android-17-os-adoption-numbers-october-2026/) (2026-10-30): Only a quarter of Android phones have even made it to Android 16. - [Nvidia’s $12.9B Hugging Face Deal Faces DOJ Antitrust Scrutiny](https://www.channelinsider.com/ai/news-nvidia-hugging-face-acquisition-doj-antitrust-scrutiny/) (2026-10-30): Nvidia already dominates much of the AI chip market. Now, its proposed acquisition of Hugging Face is raising questions about how much influence one company should have over the broader AI ecosystem. The US Department of Justice is examining Nvidia’s - [NinjaOne to Double Channel Spending in 2027, Expand MSP Support](https://www.channelinsider.com/security/news-ninjaone-double-channel-spending-2027/) (2026-10-30): NinjaOne plans to at least double its channel spending in 2027, with more support aimed at helping managed service providers (MSPs) grow their businesses rather than simply master its software. CEO Sal Sferlazza outlined the plans at NinjaOne’s MSP NXT - [Argano Acquires Oktana to Expand Salesforce AI Services](https://www.channelinsider.com/channel-business/sis-vars-advisors-and-mssp-news/argano-oktana-acquisition-salesforce-ai-consulting/) (2026-10-30): Argano has acquired Salesforce consultancy Oktana, expanding its artificial intelligence and data capabilities as the enterprise technology services firm builds out its global delivery operations. Announced October 13, the acquisition adds 227 professionals and more than 1,100 Salesforce certifications to - [Binance Reports $6.3 Billion Crypto Hack as Partners Race to Freeze Funds](https://www.esecurityplanet.com/news/news-binance-6-billion-crypto-hack-devops-breach/) (2026-10-30): Binance is investigating a reported $6.3 billion crypto breach tied to a suspected DevOps laptop compromise as partners freeze assets linked to the attack. - [4 real? Tracking exploitation and patching of eMudhra’s weak keys](https://blog.cloudflare.com/emudhra-patching/) (2026-10-30): On October 19, 2026, we learned about eMudhra’s eight shockingly weak keys: where eMudhra was trusted to pick a 115-digit number for their virtual combination lock protecting the Internet, they picked the number 4. Not even four digits, just the - [Critical PHP Vulnerabilities: What MSPs Need to Know](https://www.channelinsider.com/video/critical-php-vulnerabilities-msp-security-risks/) (2026-10-30): Critical PHP vulnerabilities are raising urgent cybersecurity concerns, but for managed service providers (MSPs), the risks go beyond patching. CISA has warned organizations about critical PHP security flaws, collectively referred to as PHP2Shell, that could expose vulnerable web servers to - [Android ‘SMS of Death’ Flaw Can Drop Emergency Calls, Trigger Reboot Loops](https://www.esecurityplanet.com/threats/news-android-sms-of-death-cve-2026-58882/) (2026-10-30): Android flaw CVE-2026-58882 allows invisible SMS messages to crash telephony services, potentially disrupting emergency calls. Here's what users should know. - [Samsung adds better sleep tracking to Galaxy Watches – here’s what to expect](https://www.zdnet.com/health/advanced-sleep-apnea-tracking-galaxy-watches/) (2026-10-30): The FDA-approved sleep apnea tracking feature will first come to the Galaxy Watch Ultra 2, Watch 9, and Ring. - [I’m finally ready for a smart calendar – why the Echo Show 16 stands out](https://www.zdnet.com/home-and-office/im-finally-ready-for-a-smart-calendar-why-the-echo-show-16-stands-out/) (2026-10-30): I’m finally ready to upgrade to a smart calendar – and Amazon’s newest Echo device looks like an organizational solution for my family and I. - [Fake PS5 Emulators on GitHub Spread Malware to Gamers](https://www.esecurityplanet.com/malware/news-fake-ps5-emulators-github-malware/) (2026-10-30): Hackers are using fake PS5 emulator repositories on GitHub to distribute malware. Learn how the infection works and what gamers can do to stay safe. - [Cloudflare Blocks 8,200 DDoS Attacks per Hour as Threats Surge](https://www.esecurityplanet.com/threats/news-cloudflare-q3-2026-ddos-attacks-surge/) (2026-10-30): Cloudflare mitigated 18.2 million DDoS attacks in Q3 2026, up 208% year over year, as shorter attacks challenged traditional network defenses. - [Why identity governance demands executive attention](https://www.csoonline.com/article/4242864/why-identity-governance-demands-executive-attention.html) (2026-10-30): The identity landscape you’re responsible for looks nothing like it did just a few years ago. Employees and contractors now share the enterprise with service accounts, machine identities, and a fast-growing population of AI agents — all accessing business systems - [Apple notifications alert victims in 99 countries about mercenary spyware infections](https://cyberscoop.com/apple-spyware-notifications-pall-mall-process/) (2026-10-30): Apple has sent new notifications of mercenary spyware infections to almost 100 countries, with recipients including journalists and documentary filmmakers. “Today’s notification is being sent to targeted users in 99 countries, and to date we have notified users in over - [Researchers Uncover 319 Chrome Extensions Hijacking Search Traffic](https://www.esecurityplanet.com/threats/news-319-chrome-extensions-search-hijacking/) (2026-10-30): Researchers found 319 Chrome extensions linked to 13.4 million installs that redirected searches through operator-controlled servers. Here's how to check. - [Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide](https://thehackernews.com/2026/10/chinese-hackers-use-ai-powered-artex-to.html) (2026-10-30): Chinese state-sponsored threat actors have been observed using a Go-based artificial intelligence (AI)-powered penetration testing framework called ARTEX in attacks aimed at high-value targets simultaneously. The activity has been attributed by CrowdStrike to a China-based "targeted intrusion adversary" it tracks - [Your Netgear router may be vulnerable to a security exploit – how to check and patch it](https://www.zdnet.com/tech/netgear-routers-vulnerable-security-exploit/) (2026-10-30): A vulnerability in some Netgear routers could allow an attacker with access to your network to run malicious commands on the device. - [North Korean Hackers Steal $6.36 Billion From Binance in Largest Crypto Hack Ever](https://gbhackers.com/north-korean-hackers-binance-theft/) (2026-10-30): North Korea’s TraderTraitor group drained about $6.36 billion from Binance wallets across ten blockchains on October 29, 2026. TRM Labs, which published the findings, calls it the largest crypto theft on record. TRM Labs says the total is about four - [26,400 Active Cloud and AI Keys Exposed in China’s Gitee Repositories](https://www.esecurityplanet.com/threats/news-gitee-26400-cloud-ai-keys-exposed/) (2026-10-30): A Gitee scan found 26,400 working cloud and AI keys, including Alibaba Cloud and DeepSeek credentials. See what APAC security teams should investigate. - [How MSPs Can Build Managed Services With Cisco IQ](https://www.channelinsider.com/channel-business/cisco-iq-msp-managed-services-automation/) (2026-10-30): For managed service providers, the next opportunity in AI-driven infrastructure management may be less about deploying new tools and more about automating the work required to maintain, secure, and modernize customers’ existing environments. Cisco is positioning its Cisco IQ platform, - [Cisco Expands Partner Incentives, Services Opportunities](https://www.channelinsider.com/channel-business/cisco-partner-incentives-services-opportunities/) (2026-10-30): Cisco is expanding its partner incentive strategy to reward more of the companies involved in customer sales and ongoing services, including advisors and developers that influence purchasing decisions without directly handling transactions. Speaking with Channel Insider at Cisco Partner Summit - [Pentagon Investigates Possible Cyberattacks Behind US Military Freezer Failures](https://www.esecurityplanet.com/news/news-pentagon-military-freezer-failures-cyberattack-investigation/) (2026-10-30): The Pentagon is investigating possible cyberattacks behind freezer failures at six US military bases, raising concerns about operational technology security. - [Smplify wants a human checkpoint between AI agents and your device fleet](https://www.computerworld.com/article/4242772/smplify-wants-a-human-checkpoint-between-ai-agents-and-your-device-fleet.html) (2026-10-30): One of the great things about Apple device management solutions is that the market for them is growing. Another is that because no two enterprises are alike, there is scope to bring different offerings to the market. I spoke with Ben Greiner, co-founder - [Google’s latest Home updates just fixed my biggest annoyances with its speakers and cameras](https://www.zdnet.com/home-and-office/google-home-gemini-updates-42-fixes/) (2026-10-30): Google details 42 fixes to its Home app and the devices compatible with it. - [From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths](https://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/) (2026-10-30): In this article Activity overviewAttack chain overviewPortable runtime staging and execution variantsHost discovery and AD CS assessmentCase 1: ESC1 abuse and the cost of an identity exclusionCase 2: PetitPotam and ESC8 turn a workstation into a domain-controller identityWhy the response - [See who has access to your Gmail inbox in 2 minutes.](https://blog.google/innovation-and-ai/technology/safety-security/google-security-checkup/) (2026-10-30): Run a quick Google Security Checkup and protect your email with three quick and easy steps. - [California officials confirm grand jury subpoenas as states, civil groups brace to protect elections from federal encroachment](https://cyberscoop.com/california-election-subpoenas-doj-voter-rolls/) (2026-10-30): The Trump administration is taking direct aim at California state election officials, issuing grand jury subpoenas to election offices statewide ahead of the final day of voting on Nov. 3. The investigations, first reported by Bloomberg, center on alleged administration - [Trezor warns of suspected crypto-theft implant in hardware wallet](https://www.bleepingcomputer.com/news/security/trezor-warns-of-suspected-crypto-theft-implant-in-hardware-wallet/) (2026-10-30): Hardware wallet device maker Trezor has received credible reports about a suspected hardware crypto-theft implant in a Trezor Safe 5 sold by its reseller CryptoBilis in Southeast Asia. - [New Framework Puts Ransomware Resilience for AI Systems in Focus](https://www.infosecurity-magazine.com/news/framework-ransomware-resilience-ai/) (2026-10-30): RAID-AI aims to help organizations assess their security preparation for ransomware attacks targeting AI systems - [L’Italia è afflitta da vulnerabilità informatiche, senza una causa chiara](https://www.darkreading.com/cybersecurity-analytics/cyber-vulnerabilities-besiege-italy-italian) (2026-10-30): I ricercatori non riescono a spiegare del tutto perché le minacce informatiche in Italia siano così diverse rispetto a quelle di qualsiasi altro Paese. - [Fake PDF and search tools hijacked searches for 13.4 million Chrome users](https://www.malwarebytes.com/blog/news/2026/10/fake-pdf-and-search-tools-hijacked-searches-for-13-4-million-chrome-users) (2026-10-30): Ads promoted browser extensions as tools to find manuals, convert PDFs, or make searches safer. But many of these extensions sent users’ search queries through servers controlled by their operators.Socket researcher John Tuckner identified 319 extensions with an estimated 13.4 - [Unauthorized Codex and Claude Code Relays Disable Security Protections at 12 Organizations](https://gbhackers.com/codex-claude-code-relays/) (2026-10-30): Symantec’s Threat Hunter Team has found an unauthorized relay service that installs the genuine OpenAI Codex and Anthropic Claude Code CLIs, then rewrites their settings to turn off sandboxing. It has affected 12 organizations since early 2026, mostly in mainland - [TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them](https://thehackernews.com/2026/10/teamviewer-flaw-lets-remote-computers.html) (2026-10-30): TeamViewer has fixed a flaw that lets the machine being controlled in a remote session attack the computer that connected to control it. In a TeamViewer session, the computer that connects and takes control is the viewer, and the machine - [Defense contractor pleads guilty to aiding North Korean remote worker scheme](https://cyberscoop.com/defense-contractor-guilty-north-korea-scheme-facilitator/) (2026-10-30): A defense contractor with top secret security clearance pleaded guilty to aiding North Korea’s remote worker scheme by allowing co-conspirators to use his identity to apply for jobs, including positions with national security implications, the Justice Department said Wednesday.  John - [Japan Faces Growing Cyberattack Crisis as AI Tools Help Hackers Target Businesses and Government](https://gbhackers.com/japan-ai-cyberattacks/) (2026-10-30): Japan is dealing with an intense wave of AI-assisted intrusions that has exposed weaknesses in its corporate and public-sector defenses. Dozens of incidents, from brokerages to delivery firms, have made data leaks routine. Japan AI cyberattacks According to reporting published - [Claude Builds Five Exploit Chains Targeting Chrome, Safari, Windows, and Linux](https://www.esecurityplanet.com/threats/news-claude-exploit-chains-chrome-linux-android/) (2026-10-30): Anthropic's Claude built exploit chains against Chrome, Safari, Windows, and Linux, and extracted files from a locked Pixel 9 during controlled security tests. - [Hackers Target Asian Governments With New NetamLoader Malware Hidden in Windows Update Files](https://gbhackers.com/netamloader-malware/) (2026-10-30): Kaspersky researchers have uncovered NetamLoader, a .NET loading framework built on XAML markup. It appears to be a supply-chain attack on a customized Windows build used only by Asian government bodies. No known APT group has been linked to it. - [Operationalizing CISA AA26-194A: Automating Cisco Router Security Assessments with Qualys Policy Audit](https://blog.qualys.com/product-tech/2026/10/30/cisa-aa26-194a-cisco-router-policy-audit) (2026-10-30): Key Takeaways CISA AA26-194A provides actionable guidance to improve the security of Internet-facing Cisco routers against real-world attack techniques. The advisory focuses on configuration hardening and security hygiene, rather than a single vulnerability or CVE. Manually validating advisory recommendations across --- # Full Content --- title: "China-backed threat group used agentic AI pentesting tool to compromise 140 sensitive targets in 11 days" url: "https://cyberscoop.com/china-vapor-panda-agentic-ai-artex-campaign-crowdstrike/" lang: "en-US" type: "post" description: "A China state-backed threat group is using ARTEX, the automated agentic AI penetration testing framework, to achieve remarkable speed, scale and success in a campaign that already compromised about 140 sensitive targets in 11 days, according to CrowdStrike.  The threat" last_modified: "2026-10-30T21:30:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://cyberscoop.com/feed/" wpe_sourcepermalink: "https://cyberscoop.com/china-vapor-panda-agentic-ai-artex-campaign-crowdstrike/" --- # China-backed threat group used agentic AI pentesting tool to compromise 140 sensitive targets in 11 days A China state-backed threat group is using ARTEX, the automated agentic AI penetration testing framework, to achieve remarkable speed, scale and success in a campaign that already compromised about 140 sensitive targets in 11 days, according to CrowdStrike.  The threat group, which CrowdStrike tracks as Vapor Panda, targeted more than 200 organizations in at least 14 countries since Oct. 17, the security company said in a [threat report](https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/) Thursday. Targets and confirmed victims include foreign ministries, a European country’s presidency and prime minister’s office, defense and intelligence agencies; 19 U.S.-based organizations in the pharmaceutical, semiconductor, defense, nuclear and financial sectors; and telecom providers in the United States, Belgium and the Philippines.  CrowdStrike told CyberScoop about 70% of Vapor Panda’s targets were confirmed compromised or had evidence indicating moderate confidence of a successful intrusion.  Vapor Panda’s use of ARTEX, paired with DeepSeek, allowed it to accomplish more tasks with shocking speed — requests occurring as often as every 10 seconds — and pursue multiple attack paths concurrently.  “This is the first time that we’re seeing an agentic adversary nation-state threat actor at this scale, and I think that this is probably, unfortunately, something we’ll see more of,” Adam Meyers, senior vice president of counter adversary operations at CrowdStrike, told CyberScoop. Hands-on-keyboard activity tracked by CrowdStrike for the past 15 years typically involved up to 40 commands per hour. “Now, with ARTEX, we could see it exceed 1,500 commands an hour,” Meyers said. “If you diversify that across 200 targets, it costs them very little to run a mass-exploitation campaign and drop a websell,” he added. “They can hit more targets in a faster period of time.” Vapor Panda’s broad-access campaign, which remains active, has targeted think tanks and government agencies spanning defense, justice, finance and diplomacy. “I would characterize it as a diverse operational mission that tends to focus on sectors and geographies that Beijing considers economically or politically important,” Meyers said. The active campaign attributed to Vapor Panda is separate from the ARTEX activity Microsoft Threat Intelligence [attributed to Storm-0940](https://cyberscoop.com/microsoft-attributes-connectwise-supply-chain-attack-china-storm-0940/) earlier this month, including a [supply-chain attack targeting ConnectWise](https://cyberscoop.com/connectwise-cloud-backup-supply-chain-attack/) customers.  Adversarial use of AI is relatively new, yet also quickly becoming the new normal, Meyers said. “We’re scrambling because we’re seeing so many of these agentic adversaries.” Agentic AI use for malicious purposes is growing month-over-month at a rate of almost threefold. CrowdStrike observed roughly 45 agentic adversary attacks in September and it’s already at 126 for October, and climbing. Adversarial use of agentic AI isn’t an intractable problem, but rather another reminder that organizations need visibility into their endpoints, identities and cross-domain capabilities, Meyers said.  These attacks aren’t showcasing anything new, “it’s just doing it at a speed and scale that we’re unaccustomed to,” he said. “It’s not hopeless, but you’ve got to take action. You can’t put your head in the sand.” The post [China-backed threat group used agentic AI pentesting tool to compromise 140 sensitive targets in 11 days](https://cyberscoop.com/china-vapor-panda-agentic-ai-artex-campaign-crowdstrike/) appeared first on [CyberScoop](https://cyberscoop.com/). --- --- title: "Yoba Malware Hides a Crypto Miner Behind Legitimate OpenAI and Anthropic Binaries" url: "https://securityaffairs.com/202149/malware/yoba-malware-hides-a-crypto-miner-behind-legitimate-openai-and-anthropic-binaries.html" lang: "en-US" type: "post" description: "Yoba malware uses fake ChatGPT and Claude apps to sideload malware through signed installers and deploy a cryptocurrency miner. Check Point Research has spent two months tracking a campaign it calls Yoba, which uses the popularity of AI tools to" last_modified: "2026-10-30T21:22:59+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://securityaffairs.com/feed" wpe_sourcepermalink: "https://securityaffairs.com/202149/malware/yoba-malware-hides-a-crypto-miner-behind-legitimate-openai-and-anthropic-binaries.html" --- # Yoba Malware Hides a Crypto Miner Behind Legitimate OpenAI and Anthropic Binaries ## Yoba malware uses fake ChatGPT and Claude apps to sideload malware through signed installers and deploy a cryptocurrency miner. Check Point Research has spent two months tracking a campaign it calls Yoba, which uses the popularity of AI tools to spread a custom malware chain. The attackers build fake GitHub projects that pose as AI desktop applications such as GPT-5.6 Sol, GPT-6 Astra and Claude Opus. The projects look convincing and run on real GitHub infrastructure, which helps them seem legitimate to potential victims. “These projects look convincing and use real GitHub infrastructure, which helps them appear legitimate to potential victims. The website exhibits search-targeted content and suspicious installer-delivery tactics consistent with an SEO-poisoning lure. _Inside the installers, there is a malicious component we refer to as the **YobaDropper**. This dropper includes another component, the **YobaLoader**, which is responsible for contacting attacker-controlled infrastructure and fetching the final payload.” [reads the report](https://research.checkpoint.com/2026/tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries/). “In this report, we describe how victims are lured to these fake projects, how the YobaDropper and YobaLoader work together, and how the attackers ultimately use this chain to run unwanted software on infected systems.”_ The lure is simple. Each project has a repository, a GitHub.io page describing the software, and a ZIP release with the malware. The repositories show no fake stars or forks, yet they still rank among the top Google results, most likely through SEO poisoning that optimizes titles, descriptions and hosting domains. [![](https://i0.wp.com/securityaffairs.com/wp-content/uploads/2026/10/image-74.png?resize=985%2C390&ssl=1)](https://i0.wp.com/securityaffairs.com/wp-content/uploads/2026/10/image-74.png?ssl=1) The first repository appeared around July 2026, but the first malicious releases landed only on August 30 and 31, and a third followed about five days later on September 4. Each repository uses a different Outlook address, and commit times point to UTC+4, UTC-4 and UTC+3, which Check Point reads as a deliberate attempt to hide the actor’s real time zone. Here’s the trick that gives the report its title. Each ZIP holds a legitimate signed executable from OpenAI or Anthropic, named Setup.exe, next to a malicious winmm.dll. The signed program loads the DLL on its own, a technique known as DLL sideloading, which is often used to bypass security protections. The ZIP files were not even password-protected. Attackers often use passwords to prevent security tools from automatically unpacking and scanning files. However, these binaries already had very low detection rates because they used anti-sandbox and other techniques to avoid analysis. The DLL’s compilation date is another clue: it was built on the same day it was added to the archive, unlike the legitimate files around it. The dropper, called YobaDropper, checks the environment before running. It calculates a hash of the name of the program that launched it and continues only if the name is Setup.exe. This means that sandboxes that run the DLL on its own will fail this check. When that happens, the process does not exit. Instead, it sleeps 200,000 times for 5.5 seconds each, a total of about 12.73 days. The malware also avoids victims in CIS countries by checking the keyboard layout. It excludes Russian, Belarusian, Tajik, Armenian, Azerbaijani, Georgian, Kazakh, Kyrgyz, Turkmen, Uzbek, and Tatar. Interestingly, Ukraine, which has often appeared in similar exclusion lists, is not included. Next, the malware requests administrator privileges. If the user does not have them, it displays the message “Please run this program as Administrator.” and exits. The victim must then restart it with administrator rights. Once it has the required privileges, the malware creates a folder called WMProcess under ProgramData. It copies the legitimate WMPDMC.exe file from System32 into this folder and places the second-stage payload there under the name wmpdui.dll. The malicious code achieves persistence by using a scheduled task dressed up as Microsoft. The author is set to Microsoft Corporation, the description says it collects device metadata for Windows Media Player, and it starts three minutes after boot as Local System. The task launches the legitimate program, which sideloads the malicious DLL. The second stage, YobaLoader, shares code with the dropper, which points to the same developer. It only runs under WMPDMC.exe and uses a different seed for its hashing than the dropper does, which separates the stages and weakens hash-based detection. Its job is to find its payload without a classic command server. It goes to a Telegram channel, t[.]me/yoba_fanclub, and downloads the channel’s profile picture. The last 50 bytes of the image seed a domain generator that builds names from word lists in the form adjective-noun-verb-number on dedyn[.]io. Change the picture and the operator gets a new domain. Then it asks Google’s DNS-over-HTTPS service for a TXT record on that domain. The reply is signed, and the loader checks the signature before decrypting it, which gives a link to a payload on Catbox. Check Point says this reliance on DoH and common hosting aims to bypass passive DNS monitoring and some gateway protections, and the campaign avoids dedicated command-and-control infrastructure, using Telegram, Tor, Catbox and DoH instead. The operator can choose how the payload runs. It can inject it into svchost.exe, save it as an executable after removing the Zone.Identifier mark, or run it as a hidden PowerShell script while bypassing execution policies. _“Finally, the injected payload into `svchost.exe` is an XMRig 6.26.0 miner with a hidden command line targeting a TLS-enabled onion mining endpoint through a local Tor SOCKS5 proxy. It can unpack and start Tor 0.4.9.12 plus lyrebird 0.8.1, monitor user-input activity to pause mining, and conditionally load the WinRing0 driver service for MSR-based mining optimization.” continnues the report._ The miner uses Tor to connect to an encrypted mining server. It can start its own Tor components, use about 85% of CPU threads, and pause mining when the user is active. It resumes after 240 seconds of inactivity and can load the WinRing0 driver to optimize mining performance. However, YobaLoader is not limited to cryptocurrency mining. Its DNS tasking system allows operators to deliver any PE executable or PowerShell payload, meaning future attacks could distribute other malware families. Earlier versions appeared in June 2026. They used Cursor.exe for sideloading, a startup shortcut for persistence, and excluded only Russia. They also used .aber[.]ir instead of dedyn[.]io and included anti-debugging and anti-VM checks that later versions dropped. Check Point believes the attackers may have Russian origins and mainly operate in the UTC-4 time zone, but this is an assessment, not a confirmed attribution. Defenders should look for suspicious WMPDMC.exe copies under ProgramData, fake Microsoft scheduled tasks, Telegram-related traffic, DNS lookups for dedyn[.]io through dns.google, and unexplained high CPU usage. _“The Yoba campaign shows how attackers can use trusted platforms and the current interest in AI tools to distribute malware in a way that looks believable and harmless at first glance. By packaging their code together with well-known software names and hosting it on GitHub, they lower the chances that users or basic security checks will immediately flag the files as suspicious.” concludes the report. “Organizations should be cautious about installing “AI helpers” or similar tools from unverified repositories and should enforce policies that restrict running software from unknown sources. Combining user awareness with basic technical controls.”_ **Follow me on Twitter: **[**@securityaffairs**](https://twitter.com/securityaffairs)** and **[**Facebook**](https://www.facebook.com/sec.affairs)** and **[**Mastodon**](https://infosec.exchange/@securityaffairs)**** [**Pierluigi Paganini**](http://www.linkedin.com/pub/pierluigi-paganini/b/742/559)**** **(**[**SecurityAffairs**](http://securityaffairs.co/wordpress/)** – hacking, Yoba malware)** --- --- title: "Critical Linux kernel flaw allows remote root attacks on MPTCP servers" url: "https://www.bleepingcomputer.com/news/security/critical-linux-kernel-flaw-allows-remote-root-attacks-on-mptcp-servers/" lang: "en-US" type: "post" description: "Security researchers at Anthropic have developed an exploit for a critical Linux kernel vulnerability that allows unauthenticated attackers to remotely execute commands as root on servers running Multipath TCP (MPTCP) listeners." last_modified: "2026-10-30T21:09:46+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.bleepingcomputer.com/feed/" wpe_sourcepermalink: "https://www.bleepingcomputer.com/news/security/critical-linux-kernel-flaw-allows-remote-root-attacks-on-mptcp-servers/" --- # Critical Linux kernel flaw allows remote root attacks on MPTCP servers Security researchers at Anthropic have developed an exploit for a critical Linux kernel vulnerability that allows unauthenticated attackers to remotely execute commands as root on servers running Multipath TCP (MPTCP) listeners. […] --- --- title: "Linux kernel exploit enables remote root attacks on MPTCP servers" url: "https://www.bleepingcomputer.com/news/security/linux-kernel-exploit-enables-remote-root-attacks-on-mptcp-servers/" lang: "en-US" type: "post" description: "Security researchers at Anthropic have developed an exploit for a critical Linux kernel vulnerability that allows unauthenticated attackers to remotely execute commands as root on servers running Multipath TCP (MPTCP) listeners." last_modified: "2026-10-30T21:09:46+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.bleepingcomputer.com/feed/" wpe_sourcepermalink: "https://www.bleepingcomputer.com/news/security/linux-kernel-exploit-enables-remote-root-attacks-on-mptcp-servers/" --- # Linux kernel exploit enables remote root attacks on MPTCP servers Security researchers at Anthropic have developed an exploit for a critical Linux kernel vulnerability that allows unauthenticated attackers to remotely execute commands as root on servers running Multipath TCP (MPTCP) listeners. […] --- --- title: "U.S. CISA adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog" url: "https://securityaffairs.com/202133/security/u-s-cisa-adds-gitlab-and-cisco-flaws-to-its-known-exploited-vulnerabilities-catalog.html" lang: "en-US" type: "post" description: "U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added GitLab and Cisco vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: Below are the flaws added to" last_modified: "2026-10-30T20:25:14+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://securityaffairs.com/feed" wpe_sourcepermalink: "https://securityaffairs.com/202133/security/u-s-cisa-adds-gitlab-and-cisco-flaws-to-its-known-exploited-vulnerabilities-catalog.html" --- # U.S. CISA adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog ## U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) [added](https://www.cisa.gov/news-events/alerts/2026/10/28/cisa-adds-two-known-exploited-vulnerabilities-catalog) GitLab and Cisco vulnerabilities to its [Known Exploited Vulnerabilities (KEV) catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog): Below are the flaws added to the catalog: - [CVE-2026-97229](https://www.cve.org/CVERecord?id=CVE-2026-97229) (CVSS score of 10.0) GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound vulnerability - [CVE-2026-76418](https://www.cve.org/CVERecord?id=CVE-2026-76418) (CVSS score of 8.6) Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability [CVE-2026-97229](https://securityaffairs.com/200868/security/gitlab-patches-max-severity-vulnerability-cve-2026-97229.html) is a critical security flaw that could let attackers run code on its servers without logging in. The flaw affects Community Edition (CE) and Enterprise Edition (EE), it is an integer overflow bug caused by weak validation of regular expressions in CI/CD configurations. The issue affects GitLab versions 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. Users should upgrade to a patched version to protect their systems. [GitLab advisory](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/) _“GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.” [reads the advisory](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/)._ The researchers [joaxcar](https://hackerone.com/joaxcar) reported this vulnerability through the company’s HackerOne bug bounty program. Alpine Linux recently [reported](https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html) that an unknown attacker tried to exploit the vulnerability against Alpine Linux on October 20 and 21, 2026, but the attempts failed. CVE-2026-76418 is a NULL pointer dereference vulnerability affecting Cisco Secure Firewall ASA and FTD Software. It could allow an unauthenticated remote attacker to force a device to reload, causing a denial-of-service (DoS) condition. Cisco said it became aware of active exploitation earlier this month. The company has not disclosed who is behind the attacks, how many organizations have been targeted, or what attackers may have done after gaining access. According to [Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities](https://cyber.dhs.gov/bod/22-01/), FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the [Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix the two vulnerabilities by November 1st, 2026. **Follow me on Twitter: **[**@securityaffairs**](https://twitter.com/securityaffairs)** and **[**Facebook**](https://www.facebook.com/sec.affairs)** and **[**Mastodon**](https://infosec.exchange/@securityaffairs) [**Pierluigi Paganini**](http://www.linkedin.com/pub/pierluigi-paganini/b/742/559) **(**[**SecurityAffairs**](http://securityaffairs.co/wordpress/)** – hacking, [CISA](https://securityaffairs.com/tag/cisa))** --- --- title: "Devs Hit by Trojanized Claude Code Extension for Cursor" url: "https://www.darkreading.com/cyberattacks-data-breaches/devs-trojanized-claude-code-extension-cursor" lang: "en-US" type: "post" description: "Two serious security issues hit Cursor on the same day, highlighting the risks for AI-powered integrated development environments (IDEs)." last_modified: "2026-10-30T20:05:58+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.darkreading.com/rss.xml" wpe_sourcepermalink: "https://www.darkreading.com/cyberattacks-data-breaches/devs-trojanized-claude-code-extension-cursor" --- # Devs Hit by Trojanized Claude Code Extension for Cursor Two serious security issues hit Cursor on the same day, highlighting the risks for AI-powered integrated development environments (IDEs). --- --- title: "$6.3 Billion Stolen from Binance in Attack Attributed to North Korea" url: "https://securityaffairs.com/202119/cyber-crime/6-3-billion-stolen-from-binance-in-attack-attributed-to-north-korea.html" lang: "en-US" type: "post" description: "Binance links a $6.3 billion crypto theft to a compromised DevOps laptop, with North Korean hackers blamed by blockchain analysts. Binance was investigating suspicious transfers that early estimates put at up to $5.8 billion. A day later, multiple media outlets" last_modified: "2026-10-30T18:50:26+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://securityaffairs.com/feed" wpe_sourcepermalink: "https://securityaffairs.com/202119/cyber-crime/6-3-billion-stolen-from-binance-in-attack-attributed-to-north-korea.html" --- # $6.3 Billion Stolen from Binance in Attack Attributed to North Korea ## Binance links a $6.3 billion crypto theft to a compromised DevOps laptop, with North Korean hackers blamed by blockchain analysts. Binance was investigating suspicious transfers that early estimates put at up to $5.8 billion. A day later, multiple media outlets reported that the largest cryptocurrency exchange had linked the theft of about $6.3 billion to a DevOps engineer’s compromised laptop. Billions had moved out of wallets linked to the exchange. According to The Block, blockchain analyst Spreek [identified](https://securityaffairs.com/202089/hacking/binance-investigates-suspicious-crypto-transfers-worth-up-to-5-8-billion.html) approximately $3.55 billion in incoming transfers to an initially unidentified wallet. _“Onchain data flagged by analyst Spreek shows about $3.55 billion in incoming transfers to the unlabeled wallet, with nearly $900 million subsequently moved across other wallets.” The Block [reports](https://www.theblock.co/news/markets/2026-10-29-binance-investigating-hack-suspicious-outflows-5-billion-432171). “Conor Grogan, a senior director and product leader at Coinbase, [says](https://x.com/jconorgrogan/status/2115912896106381513?s=20) the amount is up to $5.8 billion.”_ Coinbase executive Conor Grogan initially estimated that the total value of the movements could reach $5.8 billion. Those figures came from blockchain tracking and differing estimates, so they didn’t necessarily show the amount stolen. Binance pointed out that customer funds were safe, while co-founder Changpeng Zhao, widely known as CZ, said the activity appeared to be a hack. Zhao no longer manages Binance’s platform, but said he expected customers’ funds to be fully covered. The company said its user funds were “completely safe.” _“Our teams are aware of reports of a potential security issue and are actively investigating. User funds are completely safe. Our security teams are reviewing all relevant information with urgency, and we will provide updates through official Binance channels as soon as we have verified information.” the company states. “Users should remain cautious of scams and should not trust unofficial links, messages, or requests for account information.”_ That assurance is important, but it doesn’t replace a technical explanation of how the transfers occurred or independent confirmation of the final impact. _“Our initial investigation suggests this security incident may have started with a compromised DevOps engineer’s laptop. That gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions.” [Binance Co-CEO Richard Teng explained](https://x.com/_RichardTeng/status/2116072080525656150)._ _“To be clear: the attacker did not simply use one engineer’s permissions, and this was not a single “one-click” action. It involved a more complex attack process. Our investigation has not attributed responsibility to any individual.”_ > I want to speak to you directly about what happened. Bottom line – your money is safe, and we’re covering every loss. Our initial investigation suggests this security incident may have started with a compromised DevOps engineer’s laptop. That gave an attacker access to a… — Richard Teng (@_RichardTeng) [October 30, 2026](https://x.com/_RichardTeng/status/2116072080525656150?ref_src=twsrc%5Etfw) Attackers used access from an engineer’s laptop to reach a service container and send unauthorized withdrawal requests. Binance says it has found no evidence that attackers stole any wallet private keys. Binance also said it had found “additional points of breach” and was still investigating. Co-CEO Richard Teng said the investigation had not identified anyone responsible. After the attack, Binance suspended deposits and withdrawals to carry out security checks, cancelled the permissions linked to the affected address, and began working with blockchain analysis firms and law enforcement to track the stolen funds. Binance says it will cover all losses using its SAFU fund and its own money, and that customer funds are safe. The company also plans to publish an updated Proof of Reserves once it has completed the recovery work. This commitment does not replace a detailed technical explanation or independent confirmation of the full impact of the attack. Binance hasn’t named a culprit, but the blockchain analysis firm TRM has. It attributes the attack to [TraderTraitor](https://securityaffairs.com/tag/tradertraitor), a North Korean state-backed unit also tracked as [Lazarus Group](https://securityaffairs.com/tag/lazarus-group) and [APT38](https://securityaffairs.com/tag/apt38), and Chainalysis says it’s highly confident in that finding. > Our investigators observed funds stolen by DPRK in last month’s Bitget exploit commingling with funds stolen from Binance. We have a high degree of confidence that DPRK is responsible for the $6.4 billion hack of Binance. [https://t.co/xj9dQYcbKr](https://t.co/xj9dQYcbKr) — Chainalysis (@chainalysis) [October 30, 2026](https://x.com/chainalysis/status/2116025255965999217?ref_src=twsrc%5Etfw) TRM says the attacker moved about $6.36 billion out of Binance wallets on ten blockchains on October 29, most of it in roughly 20 minutes starting at 20:05 UTC. That makes it the largest crypto theft on record, about four times the $1.5 billion Bybit hack of February 2025. _“On October 29, 2026, an attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes starting at 20:05 UTC. That makes this the largest crypto theft on record, about four times the USD 1.5 billion Bybit hack of February 2025. Binance has confirmed a security incident and suspended withdrawals on several networks.” [TRM said](https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history). “TRM attributes the attack to TraderTraitor, North Korea’s elite hacking unit, based on robust on and off-chain intelligence. We make this judgment with high confidence. TRM is tracking the funds and alerting partners through the Beacon Network.”_ Freezing the money only went partway. Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins, and Arbitrum’s Security Council froze 8,426 ETH and 74.6 million ARB, for roughly $2.7 billion in all. But the attacker raced the freezes by selling USDT to market makers and borrowing ETH against USDT on Aave. It now holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion beyond any issuer’s reach. The early freeze numbers were messy too, Tether and Circle froze approximately $1.79 billion in stablecoins associated with the suspicious transfers in the initial reports. Those amounts describe different moments, and you shouldn’t add them without checking whether they cover distinct assets. A freeze works on tokens that have an issuer to call, and Ether and Bitcoin don’t. Hot wallets help explain how this type of theft can happen. They store cryptocurrency in systems connected to the internet, allowing exchanges to process withdrawals quickly. But this also makes strong security controls essential. Investigators still need to determine who initiated the transfers, whether they were authorized, whether attackers gained control of the wallets, and whose funds were stolen. Binance co-founder Changpeng Zhao, who no longer runs the company, said the activity looked like a hack and expected customers to be fully compensated. Large transfers alone do not prove a cyberattack, but the findings that emerged later provided strong evidence of a breach. Customers also need to be careful. Attackers often exploit the confusion after a major incident by spreading fake announcements, pretending to be support staff, and directing users to fraudulent websites. Use only Binance’s official channels, avoid unexpected links, and never share passwords, authentication codes, or wallet recovery phrases in response to unsolicited messages. Security teams should also watch for phishing emails that use the incident to pressure employees into verifying their accounts. The lesson goes beyond Binance. A public blockchain records every transaction, but it cannot show who authorized it or how attackers gained access. Blockchain transparency does not guarantee operational security. **Follow me on Twitter: **[**@securityaffairs**](https://twitter.com/securityaffairs)** and **[**Facebook**](https://www.facebook.com/sec.affairs)** and **[**Mastodon**](https://infosec.exchange/@securityaffairs)**** [**Pierluigi Paganini**](http://www.linkedin.com/pub/pierluigi-paganini/b/742/559)**** **(**[**SecurityAffairs**](http://securityaffairs.co/wordpress/)** – hacking, Binance)** --- --- title: "TeamViewer Vulnerability Lets Attackers Run Code on IT Support Staff’s PCs" url: "https://hackread.com/teamviewer-vulnerability-code-it-support-staff-pcs/" lang: "en-US" type: "post" description: "A vulnerability in TeamViewer could let attackers run code on an IT support technician’s computer when the technician…" last_modified: "2026-10-30T18:35:09+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://hackread.com/feed/" wpe_sourcepermalink: "https://hackread.com/teamviewer-vulnerability-code-it-support-staff-pcs/" --- # TeamViewer Vulnerability Lets Attackers Run Code on IT Support Staff’s PCs A vulnerability in TeamViewer could let attackers run code on an IT support technician’s computer when the technician… --- --- title: "Shield Benchmarks AI Models for IT Helpdesk Performance" url: "https://www.channelinsider.com/ai/shield-ai-helpdesk-benchmarks-it-support/" lang: "en-US" type: "post" description: "Shield Technology Partners has released new AI benchmarks showing that even leading AI models struggle to consistently resolve complex IT support tickets, raising questions about how MSPs should balance automation with technician oversight. The evaluation tested leading AI models against" last_modified: "2026-10-30T18:31:01+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.channelinsider.com/feed/" wpe_sourcepermalink: "https://www.channelinsider.com/ai/shield-ai-helpdesk-benchmarks-it-support/" --- # Shield Benchmarks AI Models for IT Helpdesk Performance Shield Technology Partners has released new AI benchmarks showing that even leading AI models struggle to consistently resolve complex IT support tickets, raising questions about how MSPs should balance automation with technician oversight. The evaluation tested leading AI models against 52 challenging support tickets that Shield’s AI Engineer had previously handled incorrectly. GPT-6 Astra with extra-high reasoning achieved the highest pass rate at 61.5%, while Claude Opus 5.5 max and Astra on high reasoning effort each passed 59.6% of cases. The findings highlight a central challenge for MSPs adopting AI-powered service desks: Technical capabilities alone do not guarantee successful service delivery. Even when AI agents completed complex tasks, they sometimes failed to follow customer instructions or established procedures, underscoring the importance of human oversight as providers expand automation. ## AI models struggle with complex IT support tickets AI systems can already handle a range of routine helpdesk tasks end-to-end, including password resets, employee onboarding and offboarding, license renewals, and firewall repairs. Forge is currently handling more than 50% of all actionable tickets for [Shield’s IT service provider partners](https://www.channelinsider.com/ai/shield-forge-ai-msp-service-delivery/), known as ShieldCos. In the new evaluation, GPT-6 Astra with extra-high reasoning passed 61.5% of tickets (32 of 52), while Claude Opus 5.5 max and Astra on high effort each passed 59.6% (31 of 52). The results showed that high model intelligence does not necessarily translate into consistent service delivery. Agents sometimes completed technically difficult work, but failed to follow customer instructions or established procedures. ## Accuracy, cost, and speed complicate AI model selection The evaluation highlights the tradeoffs between [model performance](https://www.channelinsider.com/ai/news-liquid-ai-lfm3-edge-ai-channel-partners/), processing time, and cost. Claude Opus 5.5 high passed 53.8% of cases, taking an average of 13 minutes per ticket at a cost of $3.30. Gemini 3.8 Flash high passed 36.5% of cases, taking 24 minutes per ticket at a cost of $1.60. The testing also showed that increasing Astra’s reasoning effort from low to extra high resulted in two additional successful evaluations, but increased processing time from under 10 minutes to nearly 20 minutes and cost from $5.10 to $7.60. DeepSeek V4.1 Flash low passed 25 tickets at a cost of $0.13. Shield notes that these findings provide data to guide model selection, balancing accuracy, time, and cost based on the requirements of individual tickets. The organization also noted that the reported costs and times do not include human verification, corrections, or follow-through – which can add to the overall expense of using lower-performing models. For MSPs, the findings suggest that selecting AI models based on processing costs alone could create operational challenges. Lower-cost models may offer savings on individual tickets, but those advantages can diminish when technicians must review, correct, or repeat unsuccessful work.  Providers evaluating AI [service desk tools](https://www.channelinsider.com/security/managed-services/best-help-desk-tools-for-msps/) will need to consider total resolution costs, escalation rates, and customer satisfaction alongside model performance. ## Customer instructions expose gaps in AI performance Shield’s evaluations show that AI capabilities can vary significantly, even within familiar IT workflows. Agents may successfully perform complex technical tasks while overlooking specific customer requirements or document procedures.  One example details how a customer requested a phone call about a slow computer, failed updates, and printing issues. Rather than arranging a call, Claude Opus 5.5 attempted to schedule remote maintenance through email, citing an earlier ticket as justification. Shield notes that this case demonstrates that evaluating AI performance requires more than determining whether an agent can complete a technical task. Success also depends on whether the work meets customer requirements and adheres to established procedures. Shield says the findings are already helping [frontier AI labs](https://www.channelinsider.com/channel-business/news-anthropic-ipo-filing-revenue-ai-spending-channel-partners/) identify weaknesses in IT workflows, with researchers indicating they plan to use the evaluations to guide model improvements. ## AI adoption reshapes MSP technician responsibilities Shield sees an opportunity to expand technicians’ roles beyond resolving individual tickets toward defining how AI systems should handle work as AI agents take on more service desk responsibilities.  “You go from owning individual tickets to owning the process of a ticket,” said Jon Katz, co-founder and COO of ShieldCo LISS Technologies.  Technicians help establish ideal outcomes, document which tasks can be delegated, and determine when human intervention is necessary. Shield said agents must have the authority to act within agreed-upon limits, while engineers must be able to incorporate technicians’ feedback into system improvements. The organization is also working with its ShieldCos to explore how IT service providers may need to reorganize as AI assumes more work. At one provider, some helpdesk capacity has shifted toward account management, projects, and managed AI services. Another provider is restructuring workflows to create a larger role for escalation engineers and introduce team leaders responsible for overseeing AI engineers. For MSP leaders, these changes raise broader questions about [workforce planning and service delivery](https://www.channelinsider.com/ai/building-channel-revenue/caylent-ai-it-services-business-model/). As AI takes on more routine support work, providers may need fewer resources dedicated exclusively to ticket resolution and more employees focused on escalation management, customer relationships, and AI oversight.  The transition could also create opportunities to redirect technical capacity toward higher-value services without necessarily expanding headcount. The post [Shield Benchmarks AI Models for IT Helpdesk Performance](https://www.channelinsider.com/ai/shield-ai-helpdesk-benchmarks-it-support/) appeared first on [Channel Insider](https://www.channelinsider.com/). --- --- title: "Presidio Sees Cisco Updates Fueling Managed Services" url: "https://www.channelinsider.com/channel-business/presidio-cisco-ai-managed-services-growth/" lang: "en-US" type: "post" description: "Cisco’s latest AI and infrastructure updates could create new opportunities for solution providers to expand recurring revenue through managed services, network modernization, and security operations, according to Presidio Chief Solutions Officer Dan O’Brien. Speaking with Channel Insider at Cisco Partner" last_modified: "2026-10-30T18:28:30+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.channelinsider.com/feed/" wpe_sourcepermalink: "https://www.channelinsider.com/channel-business/presidio-cisco-ai-managed-services-growth/" --- # Presidio Sees Cisco Updates Fueling Managed Services Cisco’s latest AI and infrastructure updates could create new opportunities for solution providers to expand recurring revenue through managed services, network modernization, and security operations, according to Presidio Chief Solutions Officer Dan O’Brien. Speaking with Channel Insider at Cisco Partner Summit in Vancouver, O’Brien said capabilities such as Cisco IQ and Cisco Cloud Control could help partners better understand customer environments, automate IT operations, and address growing demand for technical expertise.  Combined with Cisco’s evolving partner incentives, those capabilities could also help providers like Presidio invest in the skills and services needed to support customers’ increasingly complex IT environments. ## Cisco IQ gives partners new visibility into customer needs Presidio is a global digital services and IT solutions integrator. O’Brien says it’s [combining Cisco IQ-provided information](https://www.channelinsider.com/channel-business/news-cisco-iq-partner-ai-agents-msp-services/) with its own internal platforms, customer knowledge, and experience to develop data-driven modernization strategies and lifecycle management plans. “Cisco IQ does a really good job of surfacing solid information about what the customer has to do. My view then is where we can help a customer,” said O’Brien. “We’ve built our own internal AI platforms that look at the 6,000 customers that we have and 20 years of experience with them to figure out which technology stacks are successful and how to modernize the customers.” Security analysis is another opportunity that O’Brien identifies, with customer data helping Presidio understand challenges, identify vulnerabilities, and establish a path forward. “How can we draw an authorization strategy, specifically around having analysis? I think it really allows us to learn what challenges customers have around security by building a path forward that’s data-driven – and how do we flush out vulnerabilities and have a plan in place,” O’Brien notes. ## Cisco Cloud Control could simplify IT operations O’Brien explains that Presidio sees potential for Cisco Cloud Control and agentic capabilities to help customers simplify IT operations, particularly organizations with substantial technical debt but limited technical staff. Cisco recently expanded the offering to provide partners with new ways to build, secure, and manage AI-ready infrastructure.  O’Brien explains that customers could benefit from better operational insights, the ability to diagnose potential problems, and task automation. “Anything that drives simplicity is an asset to any one of our customers,” said O’Brien. “The customers that haven’t been able to solve this don’t have a lot of technical staff, so for me, where we have the biggest sweet spot is customers that have heavily-owned technology, but limited staff-side capability.” ## Partner incentives support technical investment and growth O’Brien says Cisco’s [partner incentives](https://www.channelinsider.com/channel-business/vendor-leadership-and-partner-programs/cisco-partner-incentives-cisco-iq-updates/) provide financial benefits for partners that demonstrate capabilities across its portfolio and invest in the associated technical expertise. While acknowledging that smaller partners may face disadvantages compared with larger organizations, O’Brien says the program rewards broader participation and investment. “What we found is: it rewards partners. When I say ‘rewards,’ there are financial incentives for us,” said O’Brien. “The broader we can demonstrate the portfolio across the different underlying architectures that they have, the more financial benefit there is for being all in the process.” Further, Presidio uses Cisco rebate programs to support investments in its workforce and technical capabilities. O’Brien explains that partners often need to develop skills and hire technical staff before customer demand fully materializes, and that Cisco incentives can help make those investments easier to support. “When I’m working with Cisco, rebate dollars are tied to driving adoption and investing in certain technical resources. It makes it a lot easier for me,” O’Brien says. ## AI security and network modernization drive services demand Before organizations deploy AI, O’Brien says they need to understand their data, [establish governance policies](https://www.channelinsider.com/ai/trustedtech-shadow-ai-governance-enterprise/), and determine what information can be shared with different models. “What I’m seeing is a huge increase in customers needing a managed service. It’s the only way to truly help a customer who’s worried about agent-based threats, because you’ve got to have automated services,” said O’Brien. “You need to have an agentic SOC where you’re using agentic AI to quickly react, understand, diagnose, react, and take actions.” Presidio uses AI across its services, including cybersecurity, networking, and data-related work. O’Brien says customers need to understand where security controls sit, who has access, and what customer data is shared to automate capabilities. “Our approach to everything we’re helping with – we do a lot more networking – is that we would walk through model selection, training the models, and having an appropriate human in the loop,” said O’Brien. “I think there’s a lot of trust that we have to talk about with a lot of our customers.” Network modernization also presents a major opportunity for Presidio, O’Brien said. Existing technical debt can create risk and increase costs, and Presidio sees an opportunity to help customers move toward modern networks with the security posture and scalability needed to support emerging AI workloads. O’Brien also highlights the difficulty customers face finding the talent needed to operate security environments themselves. “There’s a lot of different technologies that need to work together. Build the strategies for that, pick the right tools, and fundamentally make them all work together. When I say work together, it’s really around the need and the demand customers are asking for,” O’Brien says. “Security operations is massive. They can’t find the talent, they don’t know how to do it themselves, and they don’t have employees to be able to do that.” For Presidio, Cisco’s updates are an opportunity to turn infrastructure visibility and automation into ongoing customer services. The post [Presidio Sees Cisco Updates Fueling Managed Services](https://www.channelinsider.com/channel-business/presidio-cisco-ai-managed-services-growth/) appeared first on [Channel Insider](https://www.channelinsider.com/). --- --- title: "IT Distribution Earnings Show Strong Growth Across Channel" url: "https://www.channelinsider.com/channel-business/it-distribution-earnings-2026-channel-growth/" lang: "en-US" type: "post" description: "TD SYNNEX, Ingram Micro and Westcon-Comstor have each reported double-digit sales growth in their latest earnings results, signaling continued strength in IT distribution as demand for AI infrastructure, cybersecurity, cloud and networking drives technology spending. The results highlight more than" last_modified: "2026-10-30T18:24:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.channelinsider.com/feed/" wpe_sourcepermalink: "https://www.channelinsider.com/channel-business/it-distribution-earnings-2026-channel-growth/" --- # IT Distribution Earnings Show Strong Growth Across Channel TD SYNNEX, Ingram Micro and Westcon-Comstor have each reported double-digit sales growth in their latest earnings results, signaling continued strength in IT distribution as demand for AI infrastructure, cybersecurity, cloud and networking drives technology spending. The results highlight more than rising revenue. While AI infrastructure investments are helping fuel growth, margin pressures and shifting purchasing models are also changing the economics of distribution, pushing companies to expand their roles in technical enablement, digital commerce and recurring services. Although the three distributors report across different fiscal periods and use different revenue measures, their results point to a common trend: distributors are becoming increasingly important to how channel partners navigate complex customer demands and build profitable, services-led businesses. ## TD SYNNEX, Ingram Micro and Westcon-Comstor report growth TD SYNNEX reported fiscal third-quarter revenue of $21.6 billion, up 37.7% year over year, while non-GAAP gross billings increased 40% to $31.8 billion. Operating income climbed 67.6% to $643 million. CEO Patrick Zammit attributed the performance partly to enterprise AI adoption moving toward production deployments, alongside continued data center modernization and growing security and compliance requirements. Ingram Micro similarly reported record third-quarter net sales of $15.2 billion, a 20.8% year-over-year increase. Net income rose 31.8% to $131.1 million, while the company generated $251 million in operating cash flow. Growth was particularly pronounced in Advanced Solutions, where sales increased by 40%, and in cloud-based solutions, which grew by 31%. “Our record third-quarter performance reflects the breadth and resilience of our business and continued execution against the strategy we outlined at our Capital Markets Day in September,” said Ingram Micro CEO Paul Bay. Westcon-Comstor, meanwhile, reported record first-half gross sales of $3.37 billion, up 21.3%, with adjusted EBITDA increasing 13.5% to $86.7 million. Cybersecurity sales rose 21.6%, while data center and cloud infrastructure sales jumped 75%, reflecting investment in technologies [supporting AI workloads](https://www.channelinsider.com/infrastructure/news-microsoft-openai-10-billion-cloud-revenue/) and hybrid environments. ## AI infrastructure spending drives sales but pressures margins The three reports suggest that AI’s impact on distribution extends beyond demand for GPUs and servers. Ingram Micro’s results illustrate the financial trade-offs. Despite strong growth in AI infrastructure, its gross margin declined from 6.90% to 6.55%, reflecting a greater contribution from lower-margin, high-volume infrastructure transactions. TD SYNNEX also experienced gross margin compression, although operating margins improved as the business expanded. The figures suggest that distributors can benefit substantially from AI infrastructure spending without necessarily generating higher margins on individual transactions. Scale, operating efficiency and services attachment are therefore becoming increasingly important. That evolution is already visible in the companies’ partner strategies. Channel Insider previously reported on[ Ingram Micro’s investment in AI enablement and Xvantage](https://www.channelinsider.com/ai/building-channel-revenue/ingram-micro-ai-partner-strategy-enable-ai-xvantage/), as well as[ TD SYNNEX’s expansion of PartnerFirst](https://www.channelinsider.com/ai/news-td-synnex-partnerfirst-ai-agents-mcp/) with AI agents, automation and lifecycle capabilities. Westcon-Comstor’s results provide another perspective: recurring gross sales increased 20% to $2.25 billion, representing 67% of its total business. Hardware accounted for just 28% of gross sales. ## What distributor earnings mean for channel partners For MSPs, VARs, and solution providers, the broader implication is that the value of distribution increasingly extends beyond procurement. Channel Insider’s[ reporting from the 2026 GTDC Summit](https://www.channelinsider.com/channel-business/channel-analysis/it-distributors-hyperscaler-marketplaces-gtdc/) highlighted how hyperscaler marketplaces are reshaping purchasing relationships, requiring distributors to help partners remain involved in transactions and customer lifecycles. The latest earnings reinforce that shift. Distributors are investing in platforms, technical enablement and recurring-revenue models while navigating changing product economics. However, strong distributor results do not necessarily translate into stronger margins for every channel partner. Pricing volatility, infrastructure costs and the investment required to develop AI and [cybersecurity expertise](https://www.channelinsider.com/channel-business/news-europe-westcon-palo-alto-emea-partner-growth-circle/) remain significant considerations. Taken together, the earnings suggest a healthy distribution market, but one in which growth is increasingly tied to infrastructure scale and the ability to support complex, services-led customer relationships. For channel partners, the opportunity is not simply to sell more technology. It is to use the expanding capabilities of distribution to deliver more value throughout the customer lifecycle. The post [IT Distribution Earnings Show Strong Growth Across Channel](https://www.channelinsider.com/channel-business/it-distribution-earnings-2026-channel-growth/) appeared first on [Channel Insider](https://www.channelinsider.com/). --- --- title: "Anthropic Launches New Claude Tools to Measure AI Spending and Value" url: "https://www.channelinsider.com/ai/news-anthropic-claude-enterprise-ai-spending-tools/" lang: "en-US" type: "post" description: "Anthropic wants businesses to stop guessing whether their AI investments are paying off, and its latest Claude Enterprise tools aim to give them a clearer picture of spending and results. The company has made three features generally available to Claude" last_modified: "2026-10-30T18:19:02+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.channelinsider.com/feed/" wpe_sourcepermalink: "https://www.channelinsider.com/ai/news-anthropic-claude-enterprise-ai-spending-tools/" --- # Anthropic Launches New Claude Tools to Measure AI Spending and Value Anthropic wants businesses to stop guessing whether their AI investments are paying off, and its latest Claude Enterprise tools aim to give them a clearer picture of spending and results. The company has made three features generally available to Claude Enterprise customers: Smart Reports, in-app surveys, and pooled group budgets. Together, they help organizations understand how employees use Claude, identify common workflows, and manage AI spending across teams. The release comes as [businesses face growing pressure to justify their AI investments](https://www.channelinsider.com/ai/mavvrik-state-of-ai-cost-governance/), particularly as AI coding assistants and autonomous agents become more widely used. ## Smart reports connect AI spending to business output The centerpiece of the release is Smart Reports, which analyzes samples of team conversation transcripts to identify the work employees perform with Claude. Administrators can select a team, reporting period and [Claude products](https://www.channelinsider.com/ai/building-channel-revenue/claude-expansion-enterprise/) to include. The system then organizes activity into workstreams, showing associated spending, completed deliverables and recurring problems, including missing integrations and failed tool calls. ![Smart reports show how teams work in Claude.](https://assets.channelinsider.com/uploads/2026/10/smart-reports-768x420.png)Smart reports show how teams work in Claude. Image: Anthropic It also recommends ways to improve existing processes, such as turning frequently repeated tasks into reusable skills or adding instructions to code repositories. Administrators can also ask custom questions about usage and costs and save their findings as templates. Anthropic says the reports are intended to help organizations understand adoption and plan investments, not evaluate individual employees or make employment decisions. ## Surveys and shared budgets give teams more control The other two features address employee feedback and budget management. In-app surveys let administrators ask employees which Claude applications provide the most value, how the technology affects task completion times and which workflows colleagues should replicate. Responses appear in the administration console and can be exported to spreadsheets. ![In-app surveys capture feedback.](https://assets.channelinsider.com/uploads/2026/10/surveys-768x420.png)In-app surveys capture feedback. Image: Anthropic Meanwhile, pooled group budgets allow administrators to establish shared monthly spending limits for teams rather than relying exclusively on individual allowances. Individual limits remain active as additional safeguards. Both limits apply to every request, meaning employees stop when either budget is exhausted. Administrators also receive alerts when group spending reaches 50%, 75%, 95% and 100% of its allocation. ## Rising AI bills put pressure on enterprise budgets Anthropic’s announcement addresses a growing problem for businesses: [AI adoption is increasing](https://www.channelinsider.com/ai/msp-ai-revenue-growth-2026/), but spending doesn’t always come with measurable productivity gains. TechCrunch reported that Jellyfish’s analysis of 276,000 customers found Claude Code and other Anthropic-powered tools accounted for nearly one-third of proposed code changes submitted for review. Spending on those tools had also increased tenfold since the beginning of 2026, reaching approximately 2% of total engineering costs. Nicholas Arcolano, Jellyfish’s chief scientist, [told TechCrunch](https://techcrunch.com/2026/10/28/anthropic-just-launched-tools-to-show-companies-what-their-ai-spending-is-buying/): “Even if you’re saying 2% is still small, that 10x growth is growth that most CFOs didn’t plan for.” The figures illustrate why tracking usage alone is no longer sufficient. Businesses need to understand whether AI-generated work is useful, how much human intervention it requires and whether the resulting productivity gains justify the expense. ## What this means for enterprise AI buyers Anthropic’s new reporting features could influence how enterprises evaluate AI providers, particularly as organizations look for ways to measure spending against business results. Better visibility into Claude usage may help customers identify valuable workflows, but it could also encourage deeper dependence on Anthropic’s ecosystem. Once businesses build integrations, reusable skills, and established processes around a particular platform, switching providers may require additional development work and employee training. That makes portability an important consideration for enterprise buyers. Organizations should assess whether their AI workflows and reporting processes can be adapted to other providers without significant disruption. However, organizations should approach employee-level usage analysis carefully. Although Anthropic explicitly warns against using Smart Reports for performance reviews or employment decisions, businesses will need clear internal policies around data access, employee privacy and how reporting insights inform management decisions. Anthropic says customer data collected through these features is not used for model training by default. Availability also depends on organizational configurations, including certain HIPAA and encryption settings. ## What channel partners and enterprises should watch For channel partners, the release creates [an opportunity to help customers move beyond AI deployment](https://www.channelinsider.com/ai/flexera-ai-cost-management-cloud-data-platforms/) and establish measurable adoption and cost-management strategies.  Partners could also advise customers on governance policies, spending controls, and integration requirements as AI adoption expands across departments. These services may become increasingly valuable as businesses seek clearer evidence that their AI investments are producing worthwhile results. Enterprises evaluating Claude should consider whether shared budgets and reporting capabilities fit their existing financial controls and procurement processes. The ability to identify expensive workflows, reduce ineffective usage, and replicate successful applications could become increasingly important as AI spreads throughout organizations. Ultimately, AI providers will face growing pressure to demonstrate not just what their models can do, but what businesses actually get for their money. Anthropic is making that calculation part of its enterprise offering. **Other news: **[**Fortinet has introduced its FortiGuard Inline AI Security Service**](https://www.channelinsider.com/security/news-fortinet-fortigate-ai-security-service/)**, bringing cloud-delivered AI threat detection and data protection to existing FortiGate firewalls. ** The post [Anthropic Launches New Claude Tools to Measure AI Spending and Value](https://www.channelinsider.com/ai/news-anthropic-claude-enterprise-ai-spending-tools/) appeared first on [Channel Insider](https://www.channelinsider.com/). --- --- title: "Android 17 adoption hits a staggering 1% – why you really should update now" url: "https://www.zdnet.com/tech/android-17-os-adoption-numbers-october-2026/" lang: "en-US" type: "post" description: "Only a quarter of Android phones have even made it to Android 16." last_modified: "2026-10-30T18:18:24+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.zdnet.com/rss/news/" wpe_sourcepermalink: "https://www.zdnet.com/tech/android-17-os-adoption-numbers-october-2026/" --- # Android 17 adoption hits a staggering 1% – why you really should update now Only a quarter of Android phones have even made it to Android 16. --- --- title: "Nvidia’s $12.9B Hugging Face Deal Faces DOJ Antitrust Scrutiny" url: "https://www.channelinsider.com/ai/news-nvidia-hugging-face-acquisition-doj-antitrust-scrutiny/" lang: "en-US" type: "post" description: "Nvidia already dominates much of the AI chip market. Now, its proposed acquisition of Hugging Face is raising questions about how much influence one company should have over the broader AI ecosystem. The US Department of Justice is examining Nvidia’s" last_modified: "2026-10-30T18:12:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.channelinsider.com/feed/" wpe_sourcepermalink: "https://www.channelinsider.com/ai/news-nvidia-hugging-face-acquisition-doj-antitrust-scrutiny/" --- # Nvidia’s $12.9B Hugging Face Deal Faces DOJ Antitrust Scrutiny Nvidia already dominates much of the AI chip market. Now, its proposed acquisition of Hugging Face is raising questions about how much influence one company should have over the broader AI ecosystem. The US Department of Justice is examining Nvidia’s proposed $12.93 billion acquisition of Hugging Face, including whether the deal could disadvantage competing chipmakers and AI providers, according to Reuters. Hugging Face hosts AI models, datasets and development tools used by researchers, developers and businesses. The platform has more than 18 million users, over 200,000 enterprise customers and millions of models and datasets, according to [figures Nvidia shared when announcing the acquisition](https://www.channelinsider.com/channel-business/mergers-and-acquisitions/news-nvidia-acquires-hugging-face/). Regulators are questioning whether Nvidia could use ownership of this widely used platform to strengthen its position against competing chipmakers and AI providers. Officials have also sought information about Hugging Face’s competitors. A DOJ spokesperson said the department would continue prioritizing AI development, adding, “This DOJ under President Trump’s leadership will continue to prioritize advancement of Super Intelligence for the betterment of the American people,” [Reuters reported](https://www.reuters.com/world/us-doj-is-inquiring-about-nvidias-purchase-hugging-face-sources-say-2026-10-28/).  The proposed acquisition is expected to close in the first half of 2027. ## A growing investigation into Nvidia’s business The inquiry into Hugging Face comes amid broader DOJ scrutiny of Nvidia’s acquisitions, investments, sales practices, and customer relationships. Reuters reported that the department’s examination of Nvidia began under former President Joe Biden and has continued under President Donald Trump. According to Reuters, officials have also examined Nvidia’s acquisitions of SchedMD and Run, as well as its arrangement involving [AI chip startup Groq](https://www.channelinsider.com/infrastructure/news-groq-350m-nvidia-ai-neocloud/). Investigators are looking into whether Nvidia offered customers preferential access to AI chips when they also purchased its networking equipment and Groq processors. Nvidia has pledged to maintain access to SchedMD’s open-source software and says Hugging Face will continue supporting different chipmakers, cloud providers and AI companies. The inquiry does not establish wrongdoing, and the DOJ could conclude its investigation without taking legal action. ## Why Hugging Face is more than another acquisition Nvidia already supplies much of [the computing hardware behind modern AI systems](https://www.channelinsider.com/news-and-trends/nvidia-powers-easier-enterprise-ai-adoption/). Hugging Face would give it a stronger position in the software and developer community that builds those systems. That combination deserves attention because developers often choose their tools, models and computing infrastructure together. If a platform becomes closely tied to one hardware provider, even without formally blocking competitors, its recommendations, integrations and deployment options could influence purchasing decisions. For Nvidia, integrating its hardware and software could make AI development easier. For competing chipmakers, however, the concern is whether they could lose access to an important route to developers. ## What this means for AI developers and businesses [Developers who use Hugging Face](https://www.channelinsider.com/ai/news-hugging-face-microduck-physical-ai-robot/) do not need to change their workflows based on the investigation alone. The immediate question is whether the platform will remain equally accessible to users working with Nvidia hardware and alternatives from companies such as AMD. Businesses building AI applications should watch for changes to model access, hardware compatibility, cloud integrations, and pricing as the deal progresses. Maintaining the ability to move workloads between providers can help reduce dependence on a single vendor. For now, Nvidia has promised continued support for multiple providers, but the long-term implications will depend on how the acquisition proceeds and whether regulators seek conditions to protect competition. The outcome could help determine whether AI development remains an ecosystem where competing hardware and software providers can coexist, or one increasingly shaped by companies that control several layers of the technology stack. For channel partners, the proposed acquisition also raises questions about how AI infrastructure solutions will be packaged and sold. Resellers and systems integrators that support multiple hardware vendors may need to monitor whether Hugging Face’s integrations, deployment tools, and partnerships continue treating competing platforms equally.  Any shift toward Nvidia’s ecosystem could affect how partners design AI solutions and recommend infrastructure to customers. **In other news: **[**Microsoft reported $10 billion in revenue**](https://www.channelinsider.com/infrastructure/news-microsoft-openai-10-billion-cloud-revenue/)** from its commercial arrangements with OpenAI during its latest quarter, accounting for nearly 11% of its total revenue. ** The post [Nvidia’s $12.9B Hugging Face Deal Faces DOJ Antitrust Scrutiny](https://www.channelinsider.com/ai/news-nvidia-hugging-face-acquisition-doj-antitrust-scrutiny/) appeared first on [Channel Insider](https://www.channelinsider.com/). --- --- title: "NinjaOne to Double Channel Spending in 2027, Expand MSP Support" url: "https://www.channelinsider.com/security/news-ninjaone-double-channel-spending-2027/" lang: "en-US" type: "post" description: "NinjaOne plans to at least double its channel spending in 2027, with more support aimed at helping managed service providers (MSPs) grow their businesses rather than simply master its software. CEO Sal Sferlazza outlined the plans at NinjaOne’s MSP NXT" last_modified: "2026-10-30T18:08:29+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.channelinsider.com/feed/" wpe_sourcepermalink: "https://www.channelinsider.com/security/news-ninjaone-double-channel-spending-2027/" --- # NinjaOne to Double Channel Spending in 2027, Expand MSP Support NinjaOne plans to at least double its channel spending in 2027, with more support aimed at helping managed service providers (MSPs) grow their businesses rather than simply master its software. CEO Sal Sferlazza outlined the plans at NinjaOne’s MSP NXT conference in Austin, Texas, Oct. 27–29. The company also expects to hire about 1,000 employees next year, including several hundred in research and development. Alongside the spending increase, NinjaOne is expanding sales resources, business training and peer groups. For partners, the key question is whether those investments will help them win clients and deliver services more profitably. ## NinjaOne prepares larger channel budgets and global expansion Sferlazza[ ](https://www.crn.com/news/channel-news/2026/ninjaone-ceo-we-re-hiring-1-000-employees-doubling-channel-spend-in-2027)told CRN that NinjaOne could increase channel spending two- to threefold in 2027. The company has not disclosed its current channel budget or the dollar amount behind the planned increase. “We see MSPs as a critical part of our future,” he said, according to [CRN](https://www.crn.com/news/channel-news/2026/ninjaone-ceo-we-re-hiring-1-000-employees-doubling-channel-spend-in-2027). Planned investments include channel relationships and brand-building, particularly as NinjaOne expands in Japan, other Asian markets and Latin America. Sferlazza also described an [AI monitoring and governance](https://www.channelinsider.com/security/tools-and-platforms/ninjaone-vulnerability-management/) module under development and a goal of introducing one to three products annually. The company has not announced a release date for the AI module, so partners should not treat it as an available service. ## MSP program shifts from product training to sales growth In a separate CRN interview, global MSP partnerships head Paul Redding said NinjaOne’s updated approach includes white-label marketing materials, customer-facing sales guidance and educational resources. Early topics include CMMC compliance, transitioning to managed services and co-managed IT, with more pricing guidance and training planned. “I don’t need MSPs to sell RMM. I need MSPs to sell MSP,” Redding said [in the interview](https://www.crn.com/news/managed-services/2026/ninjaone-s-paul-redding-to-msps-we-should-be-helping-you-actually-grow-your-revenue).  NinjaOne is also developing peer groups focused on operational efficiency, financial performance, and growth. Redding expects a limited pilot with existing partners late in 2026, expansion to dozens of groups in 2027 and a wider global rollout by 2028. Although the pilot will start with partners, NinjaOne wants eventual participation to be vendor-neutral. ## Co-managed IT and AI services create partner opportunities NinjaOne sees demand for [co-managed IT](https://www.channelinsider.com/channel-business/helpdesk-itsm-and-other-tools/ninjaone-itam-ops-solution/), where MSPs work alongside customers’ internal IT departments rather than replacing them. Potential engagements include virtual-CIO advice, help desk extensions and assistance with AI governance. The vendor also wants MSPs to consolidate endpoint operations and reduce repetitive work for technicians. Those improvements could make it easier to take on additional customers without equivalent increases in staffing, but actual savings will depend on each provider’s contracts, tooling, and service model. ## MSPs should measure practical benefits before committing [MSPs ](https://www.channelinsider.com/channel-business/helpdesk-itsm-and-other-tools/atera-ninjaone-msp-rmm-comparison/)should judge NinjaOne’s plans by support they can actually use, not the headline budget. Before adjusting 2027 sales targets, ask which resources are available, whether fees or eligibility rules apply, and what results partners can reasonably measure. - **Small MSPs:** Explore NinjaOne’s white-label marketing campaigns and sales training, and confirm when these resources will be available to help generate qualified leads, improve conversion rates, and manage customer acquisition costs. - **Growing providers:** When expanding [co-managed IT services](https://www.channelinsider.com/security/ninjaone-browser-management-it-operations/), establish clear responsibilities for patching, alerting, and escalations, and ensure pricing and customer agreements reflect the shared workload. - **Established partners:** Before consolidating tools, assess ticket volumes, technician productivity, and integration costs to determine potential savings. Partners should also wait for the features and availability to be confirmed before offering NinjaOne’s upcoming AI-governance module to customers. Partners should also ask when peer groups will be accessible and whether margins or incentives will change. NinjaOne has not specified partner-level allocations or new financial terms. For MSP owners, the payoff should appear in customer acquisition, retention, and service margins. **Also read:**[** ****Channel Insider’s NinjaOne RMM review**](https://www.channelinsider.com/security/ninjarmm-review/)** explains the platform’s automation, patching, and pricing considerations for MSPs weighing their technology choices.** The post [NinjaOne to Double Channel Spending in 2027, Expand MSP Support](https://www.channelinsider.com/security/news-ninjaone-double-channel-spending-2027/) appeared first on [Channel Insider](https://www.channelinsider.com/). --- --- title: "Argano Acquires Oktana to Expand Salesforce AI Services" url: "https://www.channelinsider.com/channel-business/sis-vars-advisors-and-mssp-news/argano-oktana-acquisition-salesforce-ai-consulting/" lang: "en-US" type: "post" description: "Argano has acquired Salesforce consultancy Oktana, expanding its artificial intelligence and data capabilities as the enterprise technology services firm builds out its global delivery operations. Announced October 13, the acquisition adds 227 professionals and more than 1,100 Salesforce certifications to" last_modified: "2026-10-30T18:05:46+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.channelinsider.com/feed/" wpe_sourcepermalink: "https://www.channelinsider.com/channel-business/sis-vars-advisors-and-mssp-news/argano-oktana-acquisition-salesforce-ai-consulting/" --- # Argano Acquires Oktana to Expand Salesforce AI Services Argano has acquired Salesforce consultancy Oktana, expanding its artificial intelligence and data capabilities as the enterprise technology services firm builds out its global delivery operations. Announced October 13, the acquisition adds 227 professionals and more than 1,100 Salesforce certifications to Argano’s business, strengthening its expertise across Salesforce Agentforce, Data Cloud, MuleSoft, and AI-enabled application development. In an interview with Channel Insider, Argano President Sri Ayyeppen said the deal reflects a broader shift in enterprise IT consulting, as customers increasingly prioritize measurable business outcomes over traditional implementation timelines and billable hours. ## Argano adds Salesforce AI expertise with Oktana acquisition The deal marks Argano’s 15th acquisition since launching its latest growth initiative in April 2025 and its 31st since its founding in 2020. Oktana brings 227 professionals with more than 1,100 Salesforce certifications, along with a predominantly Latin American nearshore delivery model. Approximately 75% of Oktana’s first-quarter 2026 revenue came from Data & AI services, according to Argano. Ayyeppen said the acquisition addresses two priorities: expanding access to [specialized AI expertise](https://www.channelinsider.com/ai/building-channel-revenue/caylent-ai-it-services-business-model/) and building a more geographically distributed talent pool. “We just need a global talent pool,” Ayyeppen said, pointing to the evolving delivery requirements of AI-driven enterprise operations. “Taking their capability with AI and data across all our customer base, including healthcare and high-tech, was a huge higher-order value proposition idea.” For Argano, which already maintains significant operations in North America and India, Oktana adds nearshore delivery capacity and specialized Salesforce AI expertise. The deal also illustrates how enterprise solution providers are increasingly competing on their ability to [combine AI, data integration, and global delivery capabilities](https://www.channelinsider.com/video/optiv-on-ai-security-rethinking-the-mssp-playbook/) rather than individual technology implementations. ## AI pushes consulting firms beyond billable-hour models The acquisition comes as traditional consulting [models face pressure](https://www.channelinsider.com/ai/agentic-ai-saas-outcome-based-pricing/) from AI technologies that can accelerate software development, automate workflows, and reduce implementation complexity. Ayyeppen said Argano is moving away from evaluating projects primarily through staffing requirements and implementation timelines. “How much I change from an effort-based understanding of like how long is it going to take, how many people it’s going to take, like how many hours is it going to take,” he said, describing the shift toward defining an intended outcome and working backward. Ayyeppen said the consulting industry’s changing value proposition increasingly comes down to how effectively partners can integrate technology into everyday business operations. “Are we taking latency out of a process that creates speed as an equation? Are we creating better adoption of these tools that these tools now suddenly become an inherent process of how you get your day-to-day work done?” Ayyeppen also described a [changing Salesforce environment](https://www.channelinsider.com/channel-business/helpdesk-itsm-and-other-tools/servicenow-vs-salesforce/) in which organized enterprise data, agentic workflows, and conversational interfaces could reduce the need for some traditional application development. For solution providers, that shift could change both how services are packaged and how their value is measured.  As AI reduces some traditional implementation work, partners may need to build more of their offerings around data readiness, workflow integration, [governance](https://www.channelinsider.com/infrastructure/oracle-ai-world-ai-trust-lakehouse-announcements/), and ongoing optimization, with pricing and customer relationships increasingly tied to measurable business results. ## Enterprise AI adoption raises the stakes for solution providers Despite accelerating enterprise interest, Ayyeppen cautioned that translating AI experimentation into sustainable operational improvements remains difficult. “The biggest AI challenge that we all face is like there’s so many great ideas, but it’s hard to make it stick,” he said. He identified two priorities shaping enterprise AI investments: user adoption and what he calls “latency reduction,” or the time saved through more efficient processes. Rather than attempting sweeping organizational transformations immediately, Ayyeppen favors deploying a few targeted AI capabilities, validating their effectiveness, and expanding from there. He also said conversations increasingly involve multiple executive stakeholders, including CIOs, COOs, CFOs, and chief AI officers. Those discussions begin with [shared business objectives](https://www.channelinsider.com/security/cybersecurity-portfolios-services-outcomes/), such as improving forecasting, accelerating revenue growth, or increasing operating margins, before determining which technologies to implement. For consulting partners, this means technical expertise alone may no longer be enough. Success increasingly requires executive alignment, cross-functional coordination, organizational change management, and credible measurements of return on investment. The post [Argano Acquires Oktana to Expand Salesforce AI Services](https://www.channelinsider.com/channel-business/sis-vars-advisors-and-mssp-news/argano-oktana-acquisition-salesforce-ai-consulting/) appeared first on [Channel Insider](https://www.channelinsider.com/). --- --- title: "Binance Reports $6.3 Billion Crypto Hack as Partners Race to Freeze Funds" url: "https://www.esecurityplanet.com/news/news-binance-6-billion-crypto-hack-devops-breach/" lang: "en-US" type: "post" description: "Binance is investigating a reported $6.3 billion crypto breach tied to a suspected DevOps laptop compromise as partners freeze assets linked to the attack." last_modified: "2026-10-30T17:40:27+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.esecurityplanet.com/feed/" wpe_sourcepermalink: "https://www.esecurityplanet.com/news/news-binance-6-billion-crypto-hack-devops-breach/" --- # Binance Reports $6.3 Billion Crypto Hack as Partners Race to Freeze Funds Binance is investigating a reported $6.3 billion crypto breach tied to a suspected DevOps laptop compromise as partners freeze assets linked to the attack. --- --- title: "4 real? Tracking exploitation and patching of eMudhra’s weak keys" url: "https://blog.cloudflare.com/emudhra-patching/" lang: "en-US" type: "post" description: "On October 19, 2026, we learned about eMudhra’s eight shockingly weak keys: where eMudhra was trusted to pick a 115-digit number for their virtual combination lock protecting the Internet, they picked the number 4. Not even four digits, just the" last_modified: "2026-10-30T17:38:50+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://blog.cloudflare.com/tag/security/rss" wpe_sourcepermalink: "https://blog.cloudflare.com/emudhra-patching/" --- # 4 real? Tracking exploitation and patching of eMudhra’s weak keys On October 19, 2026, we learned about eMudhra’s eight shockingly weak keys: where eMudhra was trusted to pick a 115-digit number for their virtual combination lock protecting the Internet, they picked the number 4. Not even four digits, just the number 4. The other seven keys were similarly weak: 56, 66, 115, 155, 156, 230 and 237. The next day, we wrote a [blog post](https://blog.cloudflare.com/emudhra-certificate-compromise/) on the immediate action we took to mitigate this leak, and what customers [needed to do](https://blog.cloudflare.com/emudhra-certificate-compromise/#what-customers-should-do) on their end to stay secure. Now, we are sharing a more in-depth follow up on the evidence we’ve seen of exploitation, and the progress seen on visitors patching their systems. Let’s start with the scale of the problem. A certificate authority (CA) with weak keys this serious is unprecedented, and the potential consequences are significant. While there have been plenty of compromised certification authorities in the past (such as [DigiNotar](https://www.cfr.org/cyber-operations/compromise-of-certificate-issuer-diginotar), [TÜRKTRUST](https://www.infosecurity-magazine.com/news/turktrust-no-harm-from-fake-digital-certificates/), and [TrustWave](https://www.zdnet.com/article/trustwave-sold-root-certificate-for-surveillance/)), access to their keys has always been contained to a degree; these incidents gave a limited set of attackers or organizations the ability to issue fraudulent certificates. The eMudhra incident is fundamentally different; the affected intermediate private keys could be recovered almost instantly by _anyone_ from the public certificates themselves. Anyone can independently recover these same signing keys and create certificates for any domain that an unpatched client not enforcing Certificate Transparency would accept. eMudhra [announced](https://arstechnica.com/security/2026/10/disgraced-emudhra-drops-out-of-tls-business-following-certificate-debacle/) they’re exiting the public CA business and have claimed a [mistake](https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c10) in a key generation script, but have not yet shared the script. They [signed](https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c7) a certificate revocation list (CRL) with what might’ve been a correctly generated key, and subsequently corrected it to be signed with the weak key. How did that come to be and why didn’t that set off alarms? Much has to be cleared up, including the role of the auditors and cross signers. This blog proposes the fixes and next steps for organizations to ensure they are secure. ## Patching Cloudflare Our primary concern remains the security impact on Cloudflare, our customers, and the Internet as a whole. At the time of writing, all high priority Cloudflare systems have been patched. A small number of confirmed low impact tickets is being worked on. We started patching high-impact systems immediately on October 19. These included customer origin-facing proxies using [Pingora](https://blog.cloudflare.com/how-we-built-pingora-the-proxy-that-connects-cloudflare-to-the-internet/), responsible for most of our outbound connections. These were patched in hours to reject the vulnerable eMudhra keys. At the same time, we started an AI-assisted analysis of our source code to find all other systems that trust these weak keys. Within four hours we had a full analysis. We assigned a ticket with preliminary analysis for each system, and asked the team to confirm and/or adjust the analysis before the end of the day. Where high impact was identified, we asked to patch immediately, and for the lower impact, remediation was due at the end of last week. ## Has Cloudflare seen exploitation across its network? To track whenever a customer’s server (or attacker) presents a certificate signed by eMudhra’s weak keys, we added logging to Pingora. As this outbound service accounts for the vast majority of outgoing TLS connections from a Cloudflare machine, any attacker attempting to snoop using the eMudhra keys would trigger this logging. The logging finished rolling out October 21. At the time of writing, a week later, we’ve seen about 22,000 attempted handshakes with the weak eMudhra keys. Two-thirds of the attempts were fetches of test sites such as [emudhra.we-have-a-problem.com](http://emudhra.we-have-a-problem.com/) (which [we mentioned](https://blog.cloudflare.com/emudhra-certificate-compromise/#developer-guidance) in the developer guidance in our earlier post). Almost all of the remaining third went to origins who appeared to set up a certificate for themselves using the weak intermediate. Every handshake configured to verify the certificate was refused, as we already patched. About 160 of these handshakes stood out: the certificates’ Subject Alternative Names (SANs) were naming other organizations’ domains, unrelated to the Server Name Indication (SNI) requested in the handshake. Some of those names were domains related to consumer IoT devices. We noticed as well that those forged certificates were made after the keys leaked and some were valid for over two years, longer than any public CA may issue. However, these certificates looked like the servers’ own default certificates rather than part of an attempt to intercept our connections. They named domains other than the ones being connected to, so they would have failed hostname verification anyway. And in several cases, a server presented the same certificate to connections from many of our locations, which means it came from the server itself rather than from something on a single network path. Thus while there is no evidence of the weak keys being used to intercept Cloudflare’s connections so far, these keys appear to have been used to forge certificates within hours of the weakness becoming public: one of the forged certificates we saw was dated October 20 at 18:19 UTC, less than an hour after Mozilla’s bug report was made public. This does not exclude carefully targeted interception. For that we have to rely on the usual indirect signals of system compromise — and so far, we have not seen any such signals. ## How many visitors are still vulnerable? So much about patching Cloudflare, but what about our visitors? We cannot directly test whether a visitor still trusts the weak keys without breaking connections, so we have to do something more indirect. For that we used our [challenge pages](https://developers.cloudflare.com/cloudflare-challenges/challenge-types/challenge-pages/): We rolled out an update to send out two probe connections on a fraction of challenge pages: one probe to [ca1.cloudflarecaptcha.com](http://ca1.cloudflarecaptcha.com/) and one to [ca2.cloudflarecaptcha.com](http://ca2.cloudflarecaptcha.com/). Initially we installed an eMudhra signed certificate on ca1.cloudflarecaptcha.com and a regularly signed certificate on ca2.cloudflarecaptcha.com as control. Then we record whether these probes succeeded. This allows us to see if visitors that are served a challenge page still trust the weak eMudhra keys. What did we find? With 50 million probes over the last week, we see this: Big caveat upfront: by design the traffic to these challenge pages is highly skewed. There are many (unconfirmed) bots in there. Also, only clients that execute JavaScript (like browsers) will send probes. The jump in the data is due to the following changes—all times are UTC: - October 23 15:30, we changed our control endpoint to also serve an eMudhra certificate, but this time without [signed certificate timestamps](https://letsencrypt.org/2018/04/04/sct-encoding) (SCTs). There were some differences in acceptance, but not large. We could’ve added a new endpoint, but that would’ve required a slow release of our challenge platform. Changing the endpoint was easier. - October 23 16:30, our challenge platform rolled back to a previous version because of an unrelated issue. The probes returned October 27 at 10:00. - October 27 16:37, we noticed we did not send the [G3 cross-sign](https://crt.sh/?q=3094025792039A68AF6E553686410BDAB7C0D4A36B9084CBA64202E35D6EBBDD), which not all clients knew about, and added it to both endpoints. We removed SCTs from both. - October 27 16:49, we switched ca2 to chain up to the AAA Certificate Services root. - October 27 18:18, we ramped up probes to be included from 1% to 10% of all challenge pages served on non-paying customer zones. With those caveats out of the way: what do we notice? Up-to-date modern browsers are mostly patched, but bots and old browsers are not. Also embedded browsers, like Android WebView, lag behind patching with 30–40% still accepting. Over the first weekend (with the monitoring gap), we see clear evidence of patching, but afterwards we see little movement. On October 29 around 18:00 UTC, we released a detection that caught a large influx of bot traffic identifying as Chrome 150-154 on macOS. This can look like patching in the top graph, but it is actually a change in traffic classification: the same user agents show a corresponding increase in acceptance among traffic with bot signals detected in the bottom graph. Chrome 150-154 on Linux is the notable exception: its acceptance continues to decline, consistent with further patching in that cohort. Given the bot-heavy and changing traffic mix, that evidence is suggestive rather than conclusive. Otherwise, we still see little movement. Breaking down by network (ASN) we see: Across the large networks, more than half of probes still accept the compromised chain, both among traffic with no bot signals detected (top graph) and traffic with bot signals detected (bottom graph). Over the weekend we saw some patching, but afterwards the trend has been flat. The big caveat still holds: traffic is skewed by (unconfirmed) bots. But bots are also just software that need security updates. And if they’re in any way representative of overall software updates, then the picture is quite dire indeed. ## What can you do? Patch! Dennis Jackson has a great [crowdsourced website](https://emudhra.we-have-a-problem.com/) with instructions. Especially if you’re a developer on macOS, you want to follow [these instructions](https://emudhra.we-have-a-problem.com/apple.html). If you’re a Cloudflare customer, check out last week’s blog post on [what needs to be done on your end](https://blog.cloudflare.com/emudhra-certificate-compromise/#what-customers-should-do) when using certain products like WARP or Tunnel. ## Looking ahead At Cloudflare, we have a quick-revocation mechanism in place in some products. To bring it to more systems at Cloudflare and industry, we’re excited about projects like [upki](https://github.com/rustls/upki) that understand a trust store can’t be a static list of root certificate authorities, but needs the ability to be quickly updated with information like revocation and certificate transparency keys. As vulnerabilities are discovered at a faster pace than ever, it is vital that they can be addressed quickly and effectively. --- --- title: "Critical PHP Vulnerabilities: What MSPs Need to Know" url: "https://www.channelinsider.com/video/critical-php-vulnerabilities-msp-security-risks/" lang: "en-US" type: "post" description: "Critical PHP vulnerabilities are raising urgent cybersecurity concerns, but for managed service providers (MSPs), the risks go beyond patching. CISA has warned organizations about critical PHP security flaws, collectively referred to as PHP2Shell, that could expose vulnerable web servers to" last_modified: "2026-10-30T17:35:06+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.channelinsider.com/feed/" wpe_sourcepermalink: "https://www.channelinsider.com/video/critical-php-vulnerabilities-msp-security-risks/" --- # Critical PHP Vulnerabilities: What MSPs Need to Know Critical PHP vulnerabilities are raising urgent cybersecurity concerns, but for managed service providers (MSPs), the risks go beyond patching. CISA has warned organizations about critical PHP security flaws, collectively referred to as PHP2Shell, that could expose vulnerable web servers to remote code execution. For MSPs, MSSPs, and IT service providers, the incident highlights three major cybersecurity challenges: hidden software dependencies, emergency vulnerability management, and the growing threat of AI-assisted cyberattacks. In this Channel Insider video, we break down: - Why PHP vulnerabilities could affect more customer environments than expected - How hidden dependencies complicate MSP asset inventories - What AI-assisted attacks mean for incident response - How MSPs should prioritize patching, threat detection, and remediation - Why scalable vulnerability management is becoming essential for service providers **The takeaway:** MSPs need more than a patch management process. They need visibility across customer environments, coordinated incident response, and the ability to respond quickly when widespread vulnerabilities emerge. The post [Critical PHP Vulnerabilities: What MSPs Need to Know](https://www.channelinsider.com/video/critical-php-vulnerabilities-msp-security-risks/) appeared first on [Channel Insider](https://www.channelinsider.com/). --- --- title: "Android ‘SMS of Death’ Flaw Can Drop Emergency Calls, Trigger Reboot Loops" url: "https://www.esecurityplanet.com/threats/news-android-sms-of-death-cve-2026-58882/" lang: "en-US" type: "post" description: "Android flaw CVE-2026-58882 allows invisible SMS messages to crash telephony services, potentially disrupting emergency calls. Here's what users should know." last_modified: "2026-10-30T17:30:02+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.esecurityplanet.com/feed/" wpe_sourcepermalink: "https://www.esecurityplanet.com/threats/news-android-sms-of-death-cve-2026-58882/" --- # Android ‘SMS of Death’ Flaw Can Drop Emergency Calls, Trigger Reboot Loops Android flaw CVE-2026-58882 allows invisible SMS messages to crash telephony services, potentially disrupting emergency calls. Here’s what users should know. --- --- title: "Samsung adds better sleep tracking to Galaxy Watches – here’s what to expect" url: "https://www.zdnet.com/health/advanced-sleep-apnea-tracking-galaxy-watches/" lang: "en-US" type: "post" description: "The FDA-approved sleep apnea tracking feature will first come to the Galaxy Watch Ultra 2, Watch 9, and Ring." last_modified: "2026-10-30T17:29:50+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.zdnet.com/rss/news/" wpe_sourcepermalink: "https://www.zdnet.com/health/advanced-sleep-apnea-tracking-galaxy-watches/" --- # Samsung adds better sleep tracking to Galaxy Watches – here’s what to expect The FDA-approved sleep apnea tracking feature will first come to the Galaxy Watch Ultra 2, Watch 9, and Ring. --- --- title: "I’m finally ready for a smart calendar – why the Echo Show 16 stands out" url: "https://www.zdnet.com/home-and-office/im-finally-ready-for-a-smart-calendar-why-the-echo-show-16-stands-out/" lang: "en-US" type: "post" description: "I’m finally ready to upgrade to a smart calendar – and Amazon’s newest Echo device looks like an organizational solution for my family and I." last_modified: "2026-10-30T17:23:50+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.zdnet.com/rss/news/" wpe_sourcepermalink: "https://www.zdnet.com/home-and-office/im-finally-ready-for-a-smart-calendar-why-the-echo-show-16-stands-out/" --- # I’m finally ready for a smart calendar – why the Echo Show 16 stands out I’m finally ready to upgrade to a smart calendar – and Amazon’s newest Echo device looks like an organizational solution for my family and I. --- --- title: "Fake PS5 Emulators on GitHub Spread Malware to Gamers" url: "https://www.esecurityplanet.com/malware/news-fake-ps5-emulators-github-malware/" lang: "en-US" type: "post" description: "Hackers are using fake PS5 emulator repositories on GitHub to distribute malware. Learn how the infection works and what gamers can do to stay safe." last_modified: "2026-10-30T17:19:19+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.esecurityplanet.com/feed/" wpe_sourcepermalink: "https://www.esecurityplanet.com/malware/news-fake-ps5-emulators-github-malware/" --- # Fake PS5 Emulators on GitHub Spread Malware to Gamers Hackers are using fake PS5 emulator repositories on GitHub to distribute malware. Learn how the infection works and what gamers can do to stay safe. --- --- title: "Cloudflare Blocks 8,200 DDoS Attacks per Hour as Threats Surge" url: "https://www.esecurityplanet.com/threats/news-cloudflare-q3-2026-ddos-attacks-surge/" lang: "en-US" type: "post" description: "Cloudflare mitigated 18.2 million DDoS attacks in Q3 2026, up 208% year over year, as shorter attacks challenged traditional network defenses." last_modified: "2026-10-30T17:12:03+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.esecurityplanet.com/feed/" wpe_sourcepermalink: "https://www.esecurityplanet.com/threats/news-cloudflare-q3-2026-ddos-attacks-surge/" --- # Cloudflare Blocks 8,200 DDoS Attacks per Hour as Threats Surge Cloudflare mitigated 18.2 million DDoS attacks in Q3 2026, up 208% year over year, as shorter attacks challenged traditional network defenses. --- --- title: "Why identity governance demands executive attention" url: "https://www.csoonline.com/article/4242864/why-identity-governance-demands-executive-attention.html" lang: "en-US" type: "post" description: "The identity landscape you’re responsible for looks nothing like it did just a few years ago. Employees and contractors now share the enterprise with service accounts, machine identities, and a fast-growing population of AI agents — all accessing business systems" last_modified: "2026-10-30T17:09:23+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.csoonline.com/feed/" wpe_sourcepermalink: "https://www.csoonline.com/article/4242864/why-identity-governance-demands-executive-attention.html" --- # Why identity governance demands executive attention The identity landscape you’re responsible for looks nothing like it did just a few years ago. Employees and contractors now share the enterprise with service accounts, machine identities, and a fast-growing population of AI agents — all accessing business systems and data. **** Every one of those identities represents an access decision, and every access decision is now a potential point of accountability that lands on your desk. Regulators and boards want proof. They expect security leaders to show who, or what, has access to critical systems and how that access is being governed. But when human and nonhuman identities (NHIs) change faster than manual processes can keep up, proof becomes much harder to produce. [Foundry research](https://www.csoonline.com/article/4114020/cisos-top-10-cybersecurity-priorities-for-2026.html) ranks identity security among the top cybersecurity priorities for 2026, reflecting a shift in how leadership views risk: Identity has evolved from operational detail to executive concern. “The last 15 years of digital transformation has resulted in credential sprawl across the tech stack of every organization,” says Bryan Kelley, AVP, Agentic Technology Specialists at SailPoint. “Whether it’s your own trusted agents or another organization’s rogue agent, they will find and abuse these exposed credentials, API keys, tokens, and secrets to carry out their given goals.” **When accountability becomes personal** Security leaders must demonstrate that identity governance is working, not simply that policies exist. They need a real-time view of each identity and the permissions it holds as business needs change. Leaders can also face personal and professional consequences when a breach or a compliance failure occurs. Boards and regulators may expect the C-suite to show that appropriate controls and oversight were in place at the time. AI agents add to that exposure as they gain access to enterprise resources and take on more autonomous roles. This is why NHIs need the same rigor, visibility, and controls as human identities. **The shift to continuous compliance** Quarterly or annual access reviews capture a moment in time, but it’s all the other moments in between that present a problem. Between reviews, employees can change roles, contractors can leave, and new identities such as AI agents can gain access. Security teams may not catch outdated permissions or active orphaned accounts until the next review. When identity data lives in separate systems, security teams struggle even more to maintain a current view of [access across the enterprise](https://www.sailpoint.com/blog/elevating-identity-governance-from-ecosystem-silos-to-enterprise-control?utm_source=foundry&utm_medium=blg&utm_content=ww-awr-all-blg-elevating-identity-governance-from-ecosystem-silos-to-enterprise-control&utm_id=701VO000016Z2hf). Continuous identity security makes oversight part of daily operations. Rather than waiting for the next review, an identity governance platform can help validate access as conditions change, automating low-risk approvals and flagging higher-risk access for review. Governance activity also creates an ongoing record of how access was approved and whether policies were applied consistently, so teams don’t have to reconstruct that history when auditors or regulators ask for evidence. **Building an adaptive identity security program **A continuous approach is made up of three core capabilities. First, organizations need to discover and unify identities to create a centralized view of access. Second, lifecycle management, policy enforcement, and access validation become always-on activities rather than periodic projects. Finally, organizations need to maintain evidence of governance activity so they can demonstrate compliance and respond when issues arise. This approach helps security leaders keep up with constant identity changes while meeting rising expectations for accountability.** **[Learn how continuous identity security can help strengthen oversight and audit readiness.](https://www.sailpoint.com/identity-library/the-new-era-of-executive-risk?utm_source=foundry&utm_medium=blg&utm_content=ww-awr-all-wp-the-new-era-of-executive-risk&utm_id=701VO000016Z2hf) --- --- title: "Apple notifications alert victims in 99 countries about mercenary spyware infections" url: "https://cyberscoop.com/apple-spyware-notifications-pall-mall-process/" lang: "en-US" type: "post" description: "Apple has sent new notifications of mercenary spyware infections to almost 100 countries, with recipients including journalists and documentary filmmakers. “Today’s notification is being sent to targeted users in 99 countries, and to date we have notified users in over" last_modified: "2026-10-30T17:07:05+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://cyberscoop.com/feed/" wpe_sourcepermalink: "https://cyberscoop.com/apple-spyware-notifications-pall-mall-process/" --- # Apple notifications alert victims in 99 countries about mercenary spyware infections Apple has sent new notifications of mercenary spyware infections to almost 100 countries, with recipients including journalists and [documentary filmmakers](https://x.com/radwanmortada/status/2116163136252231795). “Today’s notification is being sent to targeted users in 99 countries, and to date we have notified users in over 150 countries in total,” [the company said](https://x.com/craiu/status/2116125797618467097?a=oiSKZVzZu5xQsgCx610&s=46). “The extreme cost, sophistication, and worldwide nature of mercenary spyware attacks make them some of the most advanced digital threats in existence today. As a result, Apple does not attribute the attacks or the notice you’re receiving to any specific attackers or geographical regions.” Apple didn’t immediately respond to a request for comment Friday about the countries targeted. Researchers and groups that work on spyware said the notifications were significant, however. “This again promises to be an important set of notifications with a bunch of cases, based purely on what we see publicly,” said John Scott-Railton, senior researcher at The Citizen Lab at the University of Toronto. He also posted on [social media](https://x.com/jsrailton/status/2116170989314703847) about how potential victims could defend themselves, warning people to be cautious about companies that offer paid solutions to spyware infections. He cautioned that the lack of notification doesn’t rule out an infection. The steps Apple recommends, which Scott-Railton seconded, were to enable Lockdown Mode and to get in touch with the digital rights group Access Now. “The number of Apple threat notifications we are seeing from countries around the world indicates that the fight against the scourge of spyware abuse is far from over,” said Natalia Krapiva, senior tech-legal counsel with Access Now. “While we have increased our capacity to investigate spyware abuse, and companies like Apple have done a lot to notify and protect people from it, repressive states continue to use these powerful surveillance technologies, including against civil society actors and opposition figures.” Apple sent its last major batch of notifications in August. The notifications frequently lead to victims approaching Access Now, The Citizen Lab and other groups seeking further assistance and prompting [deeper investigations](https://cyberscoop.com/pegasus-spyware-serbia-critics-elections/). The notifications come shortly before the final rounds of negotiations over industry standards for commercial hacking tools being developed under the voluntary [Pall Mall Process](https://cyberscoop.com/voluntary-pall-mall-process-seeks-to-curb-spyware-abuses/). The industry guidelines follow an earlier set of guidelines [catered to governments](https://cyberscoop.com/industry-government-nonprofits-weigh-voluntary-rules-for-commercial-hacking-tools/). “The states that will ultimately adopt these guidelines must come to terms that the current system is not working, and that the spyware industry must face some real consequences for the uncontrolled sale of these tools and refusal to curb the abuses,” Krapiva said. The post [Apple notifications alert victims in 99 countries about mercenary spyware infections](https://cyberscoop.com/apple-spyware-notifications-pall-mall-process/) appeared first on [CyberScoop](https://cyberscoop.com/). --- --- title: "Researchers Uncover 319 Chrome Extensions Hijacking Search Traffic" url: "https://www.esecurityplanet.com/threats/news-319-chrome-extensions-search-hijacking/" lang: "en-US" type: "post" description: "Researchers found 319 Chrome extensions linked to 13.4 million installs that redirected searches through operator-controlled servers. Here's how to check." last_modified: "2026-10-30T16:59:33+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.esecurityplanet.com/feed/" wpe_sourcepermalink: "https://www.esecurityplanet.com/threats/news-319-chrome-extensions-search-hijacking/" --- # Researchers Uncover 319 Chrome Extensions Hijacking Search Traffic Researchers found 319 Chrome extensions linked to 13.4 million installs that redirected searches through operator-controlled servers. Here’s how to check. --- --- title: "Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide" url: "https://thehackernews.com/2026/10/chinese-hackers-use-ai-powered-artex-to.html" lang: "en-US" type: "post" description: "Chinese state-sponsored threat actors have been observed using a Go-based artificial intelligence (AI)-powered penetration testing framework called ARTEX in attacks aimed at high-value targets simultaneously. The activity has been attributed by CrowdStrike to a China-based \"targeted intrusion adversary\" it tracks" last_modified: "2026-10-30T16:58:44+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://feeds.feedburner.com/TheHackersNews?format=xml" wpe_sourcepermalink: "https://thehackernews.com/2026/10/chinese-hackers-use-ai-powered-artex-to.html" --- # Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide Chinese state-sponsored threat actors have been observed using a Go-based artificial intelligence (AI)-powered penetration testing framework called ARTEX in attacks aimed at high-value targets simultaneously. The activity has been attributed by CrowdStrike to a China-based “targeted intrusion adversary” it tracks under the moniker Vapor Panda (previously VexatiousTemper). First identified in --- --- title: "Your Netgear router may be vulnerable to a security exploit – how to check and patch it" url: "https://www.zdnet.com/tech/netgear-routers-vulnerable-security-exploit/" lang: "en-US" type: "post" description: "A vulnerability in some Netgear routers could allow an attacker with access to your network to run malicious commands on the device." last_modified: "2026-10-30T16:58:22+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.zdnet.com/rss/news/" wpe_sourcepermalink: "https://www.zdnet.com/tech/netgear-routers-vulnerable-security-exploit/" --- # Your Netgear router may be vulnerable to a security exploit – how to check and patch it A vulnerability in some Netgear routers could allow an attacker with access to your network to run malicious commands on the device. --- --- title: "North Korean Hackers Steal $6.36 Billion From Binance in Largest Crypto Hack Ever" url: "https://gbhackers.com/north-korean-hackers-binance-theft/" lang: "en-US" type: "post" description: "North Korea’s TraderTraitor group drained about $6.36 billion from Binance wallets across ten blockchains on October 29, 2026. TRM Labs, which published the findings, calls it the largest crypto theft on record. TRM Labs says the total is about four" last_modified: "2026-10-30T16:57:47+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://gbhackers.com/feed/" wpe_sourcepermalink: "https://gbhackers.com/north-korean-hackers-binance-theft/" --- # North Korean Hackers Steal $6.36 Billion From Binance in Largest Crypto Hack Ever North Korea’s TraderTraitor group drained about $6.36 billion from Binance wallets across ten blockchains on October 29, 2026. TRM Labs, which published the findings, calls it the largest crypto theft on record. TRM Labs says the total is about four times the $1.5 billion Bybit heist of February 2025. North Korean hackers Binance theft According […] The post [North Korean Hackers Steal $6.36 Billion From Binance in Largest Crypto Hack Ever](https://gbhackers.com/north-korean-hackers-binance-theft/) appeared first on [GBHackers Security | #1 Globally Trusted Cyber Security News Platform](https://gbhackers.com/). --- --- title: "26,400 Active Cloud and AI Keys Exposed in China’s Gitee Repositories" url: "https://www.esecurityplanet.com/threats/news-gitee-26400-cloud-ai-keys-exposed/" lang: "en-US" type: "post" description: "A Gitee scan found 26,400 working cloud and AI keys, including Alibaba Cloud and DeepSeek credentials. See what APAC security teams should investigate." last_modified: "2026-10-30T16:51:46+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.esecurityplanet.com/feed/" wpe_sourcepermalink: "https://www.esecurityplanet.com/threats/news-gitee-26400-cloud-ai-keys-exposed/" --- # 26,400 Active Cloud and AI Keys Exposed in China’s Gitee Repositories A Gitee scan found 26,400 working cloud and AI keys, including Alibaba Cloud and DeepSeek credentials. See what APAC security teams should investigate. --- --- title: "How MSPs Can Build Managed Services With Cisco IQ" url: "https://www.channelinsider.com/channel-business/cisco-iq-msp-managed-services-automation/" lang: "en-US" type: "post" description: "For managed service providers, the next opportunity in AI-driven infrastructure management may be less about deploying new tools and more about automating the work required to maintain, secure, and modernize customers’ existing environments. Cisco is positioning its Cisco IQ platform," last_modified: "2026-10-30T16:37:40+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.channelinsider.com/feed/" wpe_sourcepermalink: "https://www.channelinsider.com/channel-business/cisco-iq-msp-managed-services-automation/" --- # How MSPs Can Build Managed Services With Cisco IQ For managed service providers, the next opportunity in AI-driven infrastructure management may be less about deploying new tools and more about automating the work required to maintain, secure, and modernize customers’ existing environments. Cisco is positioning its Cisco IQ platform, APIs and Model Context Protocol (MCP) capabilities as building blocks for those services, giving partners new ways to identify infrastructure risks, automate remediation and support customers whose IT environments are becoming increasingly difficult to manage. In an interview with Channel Insider at Cisco Partner Summit, Vikas Butaney, Cisco’s senior vice president of Customer Experience Product Management and Marketing, outlined how partners can turn infrastructure visibility into operational services, from software lifecycle management and vulnerability remediation to AI-assisted troubleshooting and quantum-readiness assessments. ## Cisco IQ turns infrastructure visibility into managed services Cisco rolled out several new offerings around Cisco IQ and agentic capabilities at the partner summit at the end of October, including an integration with Cisco Cloud Control. It also announced new incentives and other [enhancements to the partner program](https://www.channelinsider.com/channel-business/vendor-leadership-and-partner-programs/cisco-partner-incentives-cisco-iq-updates/). “We want to make sure that our partners are profitable. Whether it’s our IQ adoption incentive or our capabilities around what we call DSA, which is deal protection for our partners, we want to make sure that we can provide support,” said Butaney. “All of this technology and innovation would be great, but if our partners can’t use it or aren’t trained, it won’t quite advance the ball.” Butaney explains that some customers lack a complete inventory of their devices, visibility into software versions, or awareness of whether their environments follow recommended practices. Cisco IQ can [surface this information](https://www.channelinsider.com/channel-business/news-cisco-iq-partner-ai-agents-msp-services/), while partners can apply professional services and technical expertise to help mitigate risks. “Many of our customers don’t really have a good inventory of all the devices that they have,” Butaney says. “They don’t necessarily know what versions of software they’re running, and they might not be following our best practices. What we want to do is bring this visibility that IQ is creating, and then have our partners work with our enterprise and commercial customers to mitigate and remove the risk that exists in their environment.” ## AI Canvas introduces new troubleshooting capabilities Butaney says that AI is changing both the opportunities available to organizations and the risks they face. He contrasts the roughly 45-day window that existed several years ago between announcing a vulnerability and its exploitation with the only hours it takes today. Partners can help customers respond by making configuration changes, implementing software upgrades, implementing compensating controls, or using Live Protect. “The power of the agentic era is real, and there are lots of benefits, but at the same point in time, the AI threat landscape is allowing these models to chain together risks in our customers’ environments and exploit them,” said Butaney. “Where traditionally – three or four years ago – we would announce a vulnerability and you’d have 45 days before it was getting exploited, not the time to compromise can be hours.” Cisco Cloud Control’s AI Canvas is a capability that allows customers and partners to troubleshoot environments. Its capabilities can help surface recommendations, while third-party partners and enterprise customers can also build agents that integrate with Cloud Control. “Within Cloud Control, we have the capability of AI Canvas, which allows our customers and our partners to troubleshoot their environment,” said Butaney. “We can troubleshoot the customer’s environment, surface the recommendation, and help them with it. You can also have third parties build or enterprise customers build their own agents and integrate them and leverage the capability of Cloud Control. ## APIs and MCP enable automated remediation at scale APIs and MCP interfaces enable partners to [build modernization services](https://www.channelinsider.com/ai/building-channel-revenue/caylent-ai-it-services-business-model/), infrastructure-as-code capabilities, and agentic operations that can operate at machine scale, rather than relying on people to navigate individual interfaces. “IQ will continue to monitor your environment and provide this visibility,” said Butaney. “Our partners can spring into action, and then they can use our APIs and our MCP capabilities and build their modernization or infrastructure-as-code services to help modernize and protect these customers.” “Any user interface we develop – or any point-and-click interface we build – is insufficient at the machine scale that we need to move at this point in time,” said Butaney. ## Quantum readiness creates an infrastructure assessment opportunity Butaney identifies several areas where partners can help customers prepare for quantum-related security risks: assessing whether hardware supports quantum key management, reviewing encryption algorithms, and evaluating key-exchange methods and configurations. Partners can use these assessments to understand customers’ environments and help them [prepare for the transition to quantum-resistant cryptography](https://www.channelinsider.com/infrastructure/cisco-ai-operations-quantum-safe-networking/). “Where our partners can really jump in and help our customers is first getting good landscape visibility into what is in their environment,” said Butaney. “You might find that the hardware you have is not capable of quantum key management. There are protocols that are quantum resistant, so how do you move from traditional IPSec to more quantum-resistant cryptography?” Butaney also notes that quantum-related deadlines differ across countries and that some industries, including financial services, critical infrastructure, and defense, face particularly significant concerns. “When we travel around the world, every country has a different quantum deadline that they’re pursuing. All of us are concerned in the industry that if our traditional IPSec security algorithms are broken, then whether it’s your financial data or critical infrastructure data that would be compromised,” said Butaney. “So our partners can come in, do an assessment, understand the hardware, the encryption environment, and then the key management and configuration, and help our end customers prepare for the quantum era,” Butaney said. ## Where MSPs should build their own AI agents For MSPs and solution providers, the immediate opportunity is to identify where greater infrastructure visibility and automation can improve services they already deliver, rather than attempting to build entirely new AI-driven offerings from scratch. That could mean using Cisco IQ to identify outdated software and configuration risks, integrating APIs and MCP capabilities into remediation workflows, or helping customers assess infrastructure readiness for emerging security requirements. But moving toward agentic operations also requires partners to [evaluate their own technical capabilities](https://www.channelinsider.com/video/msp-ai-strategy-productivity-customer-needs/), particularly when automated systems could make changes to critical customer infrastructure. “We need to move toward this agentic operational model, with the ability to detect at machine speed and come up with recommendations, initially with a human in the loop,” Butaney said. The challenge for partners will be turning those capabilities into repeatable, commercially viable services while maintaining the technical expertise and oversight customers depend on. **WATCH MORE: How are MSPs and MSSPs evolving to meet the needs of their customers? Optiv takes us behind the scenes in **[**this episode of Channel Insider: Partner POV**](https://www.channelinsider.com/video/optiv-on-ai-security-rethinking-the-mssp-playbook/)**.** The post [How MSPs Can Build Managed Services With Cisco IQ](https://www.channelinsider.com/channel-business/cisco-iq-msp-managed-services-automation/) appeared first on [Channel Insider](https://www.channelinsider.com/). --- --- title: "Cisco Expands Partner Incentives, Services Opportunities" url: "https://www.channelinsider.com/channel-business/cisco-partner-incentives-services-opportunities/" lang: "en-US" type: "post" description: "Cisco is expanding its partner incentive strategy to reward more of the companies involved in customer sales and ongoing services, including advisors and developers that influence purchasing decisions without directly handling transactions. Speaking with Channel Insider at Cisco Partner Summit" last_modified: "2026-10-30T16:34:55+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.channelinsider.com/feed/" wpe_sourcepermalink: "https://www.channelinsider.com/channel-business/cisco-partner-incentives-services-opportunities/" --- # Cisco Expands Partner Incentives, Services Opportunities Cisco is expanding its partner incentive strategy to reward more of the companies involved in customer sales and ongoing services, including advisors and developers that influence purchasing decisions without directly handling transactions. Speaking with Channel Insider at Cisco Partner Summit in Vancouver, Tim Coogan, Cisco’s SVP of Global Partner Sales, outlined how the company’s evolving compensation model, Ecosystem Deal Registration program, and Cisco IQ platform could create additional revenue opportunities for channel partners. “We are actively looking at opportunities to blend or bring more balance to the way we compensate our partners across the entire model,” Coogan said. “I want to be clear, the transaction will always be pivotally important to us. It begins the process, but we have rewarded less on the Adopt, Expand, and Renewal. We will reward those more over time.” ## Cisco expands incentives beyond transactional partners Cisco’s new [Ecosystem Deal Registration](https://www.channelinsider.com/channel-business/vendor-leadership-and-partner-programs/cisco-partner-incentives-cisco-iq-updates/) recognizes advisors and developers who influence customer purchasing decisions without directly transacting sales. Coogan explained that the program initially offers non-commission benefits, including marketing funds, equipment, and training credits. A planned phase in spring will introduce referral bonuses paid in cash. Cisco intends to make these incentives additive, preserving the existing benefits for transactional partners rather than dividing the same incentive pool among multiple parties. “We view this as additive to the sales process. So we’re actually increasing the envelope of incentives that we’re making available to our partners, for both transacting and for non-transacting,” said Coogan. “They won’t be paid the same as a transacting partner, and what they get paid doesn’t detract from what a transacting partner gets.” “We don’t just say we’re partner first. We put real action, real dollars, and real effort behind those things, and I think it’s something that separates us,” said Coogan. “I think the idea here is that it’s easy to say something and it’s much harder to prove it. We prove it every single day.” ## Cisco IQ opens infrastructure and managed services opportunities Cisco IQ will provide customers and [partners with greater visibility](https://www.channelinsider.com/channel-business/news-cisco-iq-partner-ai-agents-msp-services/) into installed infrastructure, including where equipment is located, its condition, and the software code it is running. Coogan said this information can help partners identify customer needs and develop strategies for migration, refresh, and managed services. By making infrastructure data more accessible, Cisco expects partners to use this information to build proposals and services tailored to customers’ environments. “What Cisco IQ does is not only tell me what I have or tells me where it is, but also tells me the state of it. What code level we’re running. Is it out of the last day of support? So it gives me a democratized view of my franchise,” said Coogan. “And then, if I know what I have, and I know what shape it’s in, or where it’s been, I can then build a migration strategy, a refresh strategy, a managed services strategy around that” ## AI and security remain top partner priorities There are a number of customer problems that will create immediate demand for AI-driven infrastructure management and network intelligence. Coogan identified several potential areas, including AI inference, employee training and onboarding, security posture improvements, and [agentic security operations](https://www.channelinsider.com/security/tools-and-platforms/crowdstrike-agentic-idp-ai-agent-identity-security/). He also cited industry-specific applications, including clinical protocols in healthcare, retail shrinkage, transmission efficiency, and load management in energy and financial services.  “We talked about inference as a use case that’s used a great deal relative to AI. I think training – not training models – but training people, onboarding people. The security posture that our customers are taking is something that’s an immediate opportunity and agentic SOC is another opportunity area,” said Coogan. Looking ahead to the next year, Coogan identified AI and security as the two most important capabilities for [channel providers to prioritize](https://www.channelinsider.com/video/optiv-on-ai-security-rethinking-the-mssp-playbook/).  “AI and security, whether you go one-two, or two-one, those are the two things that matter most,” said Coogan. “Whether you’re building AI, it’s got to be secure, and if you’ve got security, that’s the first step towards AI. So I think it’s an easy answer because I think it’s just universally true. AI-enabled tools and improved access to customer information can change how partner sellers prepare for customer engagements. Rather than relying on basic discovery questions, sellers can use available information to understand customers’ infrastructure needs and business objectives before a meeting.  “I think the tools that we’re putting in the hands of our own sellers and our partner sellers, changes the way we use information to be prepared to deliver value for our customers,” said Coogan. “If I know what they have, I know what they need. I know what their objectives are as a company. I’m able to craft solutions in a much more material way than going in and asking how many employees do you have? What are the things most important to you?” ## Cisco emphasizes faster innovation across its partner ecosystem Coogan outlined three priorities underpinning Cisco’s agile partner ecosystem: continuous innovation, faster response, and efficient scaling. He said that innovation can no longer be limited to scheduled cycles and that Cisco must avoid allowing its size to slow its response to partners and customers. Coogan also emphasized distribution and the importance of getting solutions into partners’ hands in real time. “The agile partner ecosystem is based on three things: continuous innovation, reacting faster, and scaling efficiently,” said Coogan. “I think the days of innovating on a cycle are gone. I think innovation has to happen in a near continuous virtuous cycle. I think that the ability to react fast, and again, we’re a large company. We can’t let large be an excuse for slow.” The post [Cisco Expands Partner Incentives, Services Opportunities](https://www.channelinsider.com/channel-business/cisco-partner-incentives-services-opportunities/) appeared first on [Channel Insider](https://www.channelinsider.com/). --- --- title: "Pentagon Investigates Possible Cyberattacks Behind US Military Freezer Failures" url: "https://www.esecurityplanet.com/news/news-pentagon-military-freezer-failures-cyberattack-investigation/" lang: "en-US" type: "post" description: "The Pentagon is investigating possible cyberattacks behind freezer failures at six US military bases, raising concerns about operational technology security." last_modified: "2026-10-30T16:28:16+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.esecurityplanet.com/feed/" wpe_sourcepermalink: "https://www.esecurityplanet.com/news/news-pentagon-military-freezer-failures-cyberattack-investigation/" --- # Pentagon Investigates Possible Cyberattacks Behind US Military Freezer Failures The Pentagon is investigating possible cyberattacks behind freezer failures at six US military bases, raising concerns about operational technology security. --- --- title: "Smplify wants a human checkpoint between AI agents and your device fleet" url: "https://www.computerworld.com/article/4242772/smplify-wants-a-human-checkpoint-between-ai-agents-and-your-device-fleet.html" lang: "en-US" type: "post" description: "One of the great things about Apple device management solutions is that the market for them is growing. Another is that because no two enterprises are alike, there is scope to bring different offerings to the market. I spoke with Ben Greiner, co-founder" last_modified: "2026-10-30T16:23:47+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.computerworld.com/security/feed/" wpe_sourcepermalink: "https://www.computerworld.com/article/4242772/smplify-wants-a-human-checkpoint-between-ai-agents-and-your-device-fleet.html" --- # Smplify wants a human checkpoint between AI agents and your device fleet One of the great things about [Apple device management](https://www.computerworld.com/article/4226159/jamf-in-the-age-of-agentic-it-an-interview-with-ceo-beth-tschida.html) solutions is that [the market for them is growing](https://www.computerworld.com/article/4154950/apples-mac-grabs-11-of-us-enterprise-market-share.html). Another is that because no two enterprises are alike, there is scope to bring different offerings to the market. I spoke with Ben Greiner, co-founder and COO of [Smplify](https://www.smplify.com/), a new-to-market device management vendor, to find out what his company provides to IT. Smplify, which [just announced $1m in pre-seed funding](https://www.smplify.com/blog/smplify-raises-1m-pre-seed/?utm_source=smplify&utm_medium=linkedin&utm_campaign=preseed-launch&utm_content=company-page), offers what could be described as a headless management tool: everything it does is available through the API and CLI. In use, that means you can build it and wield it from within the tools you already use, Greiner explained.  He’s building the company with Preetham Gurram, known in device management circles for his work at MobileIron, SOTI, Automox, Addigy, Scalefusion, and Apple, where he contributed to Apple’s core MDM platforms and zero-touch enrollment at scale. ## **So, who needs this?** “Device management still assumes a person is watching,” said Greiner. “Admins already automate with scripts and pipelines, and now AI agents are showing up that can act on a fleet at machine speed.” The challenge for IT is that AI is beginning to take actions, rather than suggest them. That means IT must put systems in place to manage and audit the actions AI takes. “Enterprises that win won’t be the ones with the smartest agents; they’ll be the ones that can say exactly what each agent is allowed to do and prove what it did,” he said. That’s a fair assessment of how things stand. OneTrust’s [2026 AI-ready governance report](https://www.onetrust.com/resources/onetrust-2026-ai-ready-governance-report/) found that 87% of organizations are encouraging the use of AI agents, but only 47% have clear governance and controls in place. That’s a problem waiting for a disaster. A recent report from Gartner [predicts](https://www.hcamag.com/ca/specialization/transformation/ai-deployment-continues-despite-ai-related-incidents-report/589804) that 40% of enterprises will demote or decommission autonomous AI agents in the coming months (“by 2027”) because of governance gaps detected only after incidents take place. Patching those gaps is [expected to become](https://www.applemust.com/jamf-brings-powerful-ai-governance-solution/) a big business. ## **Who watches the watchmen?** Once agents can submit changes at lightning speed, who can approve them? How widely deployed can those changes be? The risk is “an agent with the right key can wipe thousands of laptops before anyone notices,” Greiner told me. This is a matter of AI governance and is something I know is in the thoughts of leaders at other device management companies, including [Jamf](https://www.computerworld.com/article/4225562/from-admin-to-architect-jamfs-vision-for-the-autonomous-apple-enterprise.html) and [Fleet](https://www.computerworld.com/article/4232577/fast-ai-slow-rollback-the-risk-facing-apple-it-teams.html). “AI is happening whether organizations know it or not. That’s the problem. You can try to block it, but that’s very hard to do well. It’s far better to build visibility and governance around it,” [Jamf CEO Beth Tschida told me earlier this year](https://www.computerworld.com/article/4225562/from-admin-to-architect-jamfs-vision-for-the-autonomous-apple-enterprise.html). Jamf launched its own AI Governance suite in July, focused on AI tool discovery, policy enforcement, and reporting. The Smplify approach puts some of these decisions into the management workflow itself. “Preetham calls it the last-mile control plane: the final checkpoint between what an agent decides and what actually happens on a device,” Greiner said. ## **What are the risks of unmanaged AI? ** While most of the conversation is focused on the risk of data leakage or malware, the other risk is lack of accountability. What if an agent gets bad instructions or hallucinates an inappropriate solution to a problem, and then pushes a destructive change across the fleet? By then it’s too late to figure out why it happened and becomes a potentially costly damage limitation exercise. Fleet CEO Mike McNeil pointed out that part of the risk lies in the difficulty and [cost of recovery after an incident](https://www.computerworld.com/article/4232577/fast-ai-slow-rollback-the-risk-facing-apple-it-teams.html). “I’d frame risk by two things: how much privilege the code runs with and how hard recovery is,” he said, noting the risk of scripts running at root, which can take full control of the machine to the extent that reversion can’t undo what’s done. Greiner thinks the way to minimize the impact of such damage is to create strong rules and boundaries, and to ensure any risky actions are held back pending human approval. The agent can see a problem and create a solution, but can’t apply that fix until IT gives it the go-ahead. It’s very like how human IT works, only now it’s the machine that must report to the boss. Every change is logged with who asked for it, the intent behind it, and the person or policy that approved it. ## **Creating the opportunity space** Smplify has built its own platform to help manage devices, including AI management. That platform leans into the native protocols of the platforms it supports, naturally including Apple’s [Declarative Device Management](https://www.computerworld.com/article/4016094/ddm-a-glorious-dawn-for-apple-device-management.html) (DDM).  “Admins describe what should be true of their devices, and Smplify keeps it true. If a device drifts from that intent, because a setting changed or an update was missed, the platform notices and brings it back in line, automatically or with an admin’s approval, depending on the rules they’ve set,” Greiner said. He explained how many IT teams use GitOps to “bring discipline” to device management: configuration lives in GitHub, changes go through pull requests, and there’s a history of what happened. It works, but it adds new layers to the management task. He claims his solution has that discipline (versioned intent, review, and approval, and a full history) built in. ## **Boundaries, Apple and DDM** In the end, I get the feeling that AI management will embrace some of the ideas put in place with Apple DDM. If you think about it, DDM lets IT define a state and leaves it to the tech to work within that definition, and that same sense of boundary setting may be part of the future for AI in IT. AI will be given agency within limited boundaries. Greiner pointed out, “Apple has also been giving admins controls over Apple Intelligence features, and I expect that to keep expanding as businesses want a say in which AI runs on company devices. Apple’s privacy stance also suits governed AI well: do things on-device where possible and keep a clear line around what leaves it.” There is one more thing. Because Smplify is an MDM platform while also being API-first, Greiner explained that software companies can offer native device management inside their own products, under their own name, using his company’s solution.  **Now please subscribe to my daily, human-curated Apple-related news headline feed at **[**The Core**](https://thecorenews.substack.com/p/welcome-to-the-core?r=5l3lg)**, or follow me on** [**BlueSky**](https://bsky.app/profile/jonnyevanssays.bsky.social), [**LinkedIn**](http://www.linkedin.com/in/jonnyevans)**, or [Mastodon](https://social.vivaldi.net/@jonnyevans).** --- --- title: "Google’s latest Home updates just fixed my biggest annoyances with its speakers and cameras" url: "https://www.zdnet.com/home-and-office/google-home-gemini-updates-42-fixes/" lang: "en-US" type: "post" description: "Google details 42 fixes to its Home app and the devices compatible with it." last_modified: "2026-10-30T16:14:11+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.zdnet.com/rss/news/" wpe_sourcepermalink: "https://www.zdnet.com/home-and-office/google-home-gemini-updates-42-fixes/" --- # Google’s latest Home updates just fixed my biggest annoyances with its speakers and cameras Google details 42 fixes to its Home app and the devices compatible with it. --- --- title: "From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths" url: "https://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/" lang: "en-US" type: "post" description: "In this article Activity overviewAttack chain overviewPortable runtime staging and execution variantsHost discovery and AD CS assessmentCase 1: ESC1 abuse and the cost of an identity exclusionCase 2: PetitPotam and ESC8 turn a workstation into a domain-controller identityWhy the response" last_modified: "2026-10-30T16:11:44+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.microsoft.com/en-us/security/blog/feed/" wpe_sourcepermalink: "https://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/" --- # From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths In this article - [Activity overview](https://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/#activity-overview) - [Attack chain overview](https://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/#attack-chain-overview) - [Portable runtime staging and execution variants](https://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/#portable-runtime-staging-and-execution-variants) - [Host discovery and AD CS assessment](https://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/#host-discovery-and-ad-cs-assessment) - [Case 1: ESC1 abuse and the cost of an identity exclusion](https://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/#case-1-esc1-abuse-and-the-cost-of-an-identity-exclusion) - [Case 2: PetitPotam and ESC8 turn a workstation into a domain-controller identity](https://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/#case-2-petitpotam-and-esc8-turn-a-workstation-into-a-domain-controller-identity) - [Why the response outcomes differed](https://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/#why-the-response-outcomes-differed) - [Actionable investigation methods](https://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/#actionable-investigation-methods) - [References](https://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/#references) - [Learn More](https://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/#learn-more) Microsoft Threat Intelligence investigated two human-operated intrusions in which threat actors used Microsoft Teams messages and calls to impersonate IT or help desk personnel and socially engineer users into granting interactive remote access, primarily through Quick Assist. Once connected, the threat actors staged portable Python, Bun, or Java runtimes, performed host and network discovery, and assessed Active Directory Certificate Services (AD CS) for certificate-based authentication paths. Although the incidents began with the same social-engineering and remote-access pattern, they diverged at the certificate layer. In Case 1, the threat actor abused an Enterprise CA Security Configuration 1 (ESC1) -vulnerable certificate template to obtain authentication certificates for privileged accounts and performed DCSync. In Case 2, the threat actor used PetitPotam, a technique that causes a Windows server to authenticate to an attacker-controlled system. The attacker relayed the domain controller’s New Technology (NT) LAN Manager (NTLM) authentication to AD CS Web Enrollment (ESC8), obtained a certificate for the domain-controller account, and used it for certificate-based Kerberos authentication (PKINIT – Public Key Cryptography for Initial Authentication). This intrusion pattern is high impact because a user-approved remote session can become certificate-backed access to privileged identities and domain infrastructure. In Case 1, Microsoft Defender attack disruption restricted covered identities and blocked substantial follow-on activity, but a privileged identity excluded from automated containment remained usable and later supported data exfiltration. In Case 2, Defender generated ESC8-related alerts, after which the customer isolated the associated workstation and no further progression was observed. The activity did not exploit a vulnerability in Microsoft Teams; instead, it relied on social engineering and insecure or overly permissive AD CS configurations. In this blog, we analyze the shared attack chain, the ESC1 and ESC8 certificate-abuse paths, and the different response outcomes. We also provide investigation methods, mitigation recommendations, Microsoft Defender detection guidance, and advanced hunting queries to help defenders identify and interrupt this access path. The activity described here is not attributed to a specific threat actor. ## Activity overview ### Risk to enterprise environments - AD CS can turn a certificate request into a durable authentication path. An attacker who obtains an authentication certificate for a privileged user or machine account can use that certificate independently of the initially compromised password. Resetting the user’s password or reimaging the first workstation does not revoke an issued certificate or invalidate Kerberos tickets that have already been issued. - Two AD CS abuse techniques are central to these incidents: - **ESC1 – certificate template abuse: **A low-privileged requester abuses a misconfigured authentication-capable template that permits requester-supplied identity information and broad enrollment, allowing the requester to obtain a certificate for a privileged account. - **ESC8 – NTLM relay to Web Enrollment: **An attacker relays a user or machine account’s NTLM authentication to an AD CS web enrollment endpoint that lacks relay protections, then requests a certificate as the relayed identity. - Attackers can use Microsoft Teams to impersonate IT support personnel and persuade users to approve a remote session, gaining hands-on-keyboard access without a conventional malware attachment. - Portable or renamed runtimes such as Python, Bun, and Java can execute attacker-controlled scripts from user-writable locations while retaining legitimate file metadata. - Automated disruption is most effective when every compromised identity and device remains eligible for containment; exclusions can preserve the attacker’s path. ## Attack chain overview Both incidents followed the same initial sequence: help desk impersonation through Teams, a user-approved Quick Assist or other remote-support session, archive transfer and extraction, portable runtime execution, and host and AD CS discovery. The certificate technique and response outcome then split into two distinct branches. ![Diagram showing the shared attack chain with Teams help desk impersonation, remote access, runtime execution, and AD CS discovery, branching into ESC1 certificate-template abuse and ESC8 NTLM relay, with different containment outcomes.](https://www.microsoft.com/en-us/security/blog/wp-content/uploads/2026/10/image-13.webp)Figure 1. Both incidents followed a shared entry and execution pattern before diverging into two AD CS abuse paths. Case 1 used an ESC1-vulnerable certificate template to obtain certificates for privileged identities. Case 2 used PetitPotam to coerce domain-controller authentication and relay it to AD CS Web Enrollment through ESC8. The response outcomes differed based on containment coverage and removal of the active execution point. ### Shared initial access and execution pattern #### Teams helpdesk impersonation and remote access Both incidents began with Teams phishing messages and calls that impersonated support personnel. The social engineering **persuaded a user to establish an attacker-controlled remote session**, primarily by guiding the user to open Quick Assist and provide the connection code. This gave the attacker hands-on-keyboard access to the workstation. Across the broader activity, organization-themed onmicrosoft.com tenant names and support-oriented display names were used to make the external contact appear familiar. ![Microsoft Teams call interface showing an external caller with “External” and “Scam suspected” warnings, illustrating visible signals of a support-impersonation attempt.](https://www.microsoft.com/en-us/security/blog/wp-content/uploads/2026/10/image-14.webp)Figure 2. Example Teams call displaying External and Scam suspected indicators. These labels are important user-facing signals during support impersonation attempts. The remote session was the decisive transition in the attack. Immediately after the user granted control through Quick Assist, the attacker used the session to place an archive in the victim’s Downloads folder. Commands launched during the session created a KB-prefixed staging directory under the user’s profile, extracted the archive into that directory, and started the included payload with a portable Python, JavaScript, or Java runtime. The payload then performed host and network discovery and began assessing AD CS. ## Portable runtime staging and execution variants The runtime and packaging varied between deployments, but the execution pattern remained consistent: an archive was placed on the device during the remote session, extracted into a newly created user-profile directory, and used to launch attacker-controlled code. In one JavaScript variant, a renamed executable retained version metadata identifying it as the Bun runtime and launched the staged loader. A separate variant used a staged Java runtime to launch a Java source file. ![Sanitized command showing a renamed Bun runtime launched from an update-themed, user-writable staging directory to execute an attacker-controlled script after remote access.](https://www.microsoft.com/en-us/security/blog/wp-content/uploads/2026/10/image-15.webp)Figure 3. Sanitized Bun staging command. The update-themed path, renamed runtime, script operand, and remote-session context form the useful investigation pattern. File names alone are weak indicators. The actionable pattern is a portable runtime launched from a newly created, user-writable staging directory after an unauthorized remote session, followed by script execution, discovery commands, or connections to identity infrastructure. ![Sanitized command showing a portable Java runtime launched from a user-writable staging directory to execute an attacker-controlled Java source file.](https://www.microsoft.com/en-us/security/blog/wp-content/uploads/2026/10/image-16.webp)Figure 4. Sanitized Java staging variant. The campaign could substitute runtime and packaging choices while keeping the broader access pattern. The Java variant confirms that runtime choice can change between deployments. The AD CS behavior in each incident should be validated through the initiating process, account, device, and certificate records rather than assumed from the presence of Bun or Java alone. ## Host discovery and AD CS assessment The staged components queried Windows version information, network configuration, and running processes. These commands are common in administration, but they become high-value signals when it is launched by a renamed runtime from an uncommon location and follow an unexpected remote-support session. ![Sanitized command output showing Windows version, network-configuration, and running-process discovery initiated by a staged runtime after an unauthorized remote session.](https://www.microsoft.com/en-us/security/blog/wp-content/uploads/2026/10/image-17.webp)Figure 5. Host-discovery commands from the first draft. Their value comes from the initiating staged runtime, user-writable path, and preceding unauthorized remote session. The compromised workstation also connected to domain infrastructure using LDAPS and SMB. From this shared workstation foothold, the incidents followed different certificate-abuse paths. In Case 1, the attacker exploited an ESC1-vulnerable certificate template. In Case 2, the attacker used PetitPotam to coerce domain-controller authentication and relay it to AD CS Web Enrollment through ESC8. ## Case 1: ESC1 abuse and the cost of an identity exclusion ### ESC1 certificate requests expand privilege The first Teams-phishing wave targeted three user accounts and compromised one workstation. From the shared foothold described above, the attacker examined AD CS for a privilege-escalation path. ![Diagram showing Teams help desk impersonation leading to remote access and ESC1 certificate abuse. Defender restricted most compromised identities, but an excluded privileged account remained available and was later used for data exfiltration.](https://www.microsoft.com/en-us/security/blog/wp-content/uploads/2026/10/image-18.webp)Figure 6. Case 1: Help desk impersonation led to ESC1 certificate abuse. Attack disruption restricted most compromised identities, but an excluded privileged account remained usable and later supported data exfiltration. The attacker found a certificate template vulnerable to ESC1. ESC1 describes a template configuration in which a requester can supply identity information in the certificate request and obtain a certificate that supports authentication. When broad enrollment rights and weak issuance controls are combined with that setting, a low-privileged account can request a certificate representing a privileged identity. In the first wave, the attacker obtained certificates for three highly privileged accounts. Microsoft Defender attack disruption targeted the initially compromised user and those three certificate-compromised identities. Remote logons and Server Message Block (SMB) access were restricted and active sessions were disconnected. One privileged account was excluded from automated response, so containment did not apply to that identity. ### **Renewed phishing and ESC1 privilege expansion** About 90 minutes after the first disrupted session, the attacker launched a larger Teams-phishing wave targeting 16 users and compromised another workstation. The attacker again abused the ESC1-vulnerable template, this time obtaining certificates for eight additional privileged accounts. Attack disruption targeted the newly compromised user and the eight certificate-compromised identities. More than 1,000 subsequent SMB file-access attempts and additional logon attempts were blocked, limiting the attacker’s ability to reuse those accounts for lateral movement. ### DCSync, the excluded account, and data theft Within seconds of obtaining one privileged certificate, the attacker authenticated to a domain controller and performed DCSync while containment was taking effect. Attack disruption limited additional replication and follow-on use, but the operation had already begun. The privileged account excluded during the first disruption remained available. The attacker continued to use it for network and remote-interactive logons, reached a file server, and launched a renamed copy of Rclone using the filename SearchApp.exe. The command recursively copied data from a file-server share to an external Secure File Transfer Protocol (SFTP) destination, used 20 concurrent transfers, selected files up to three years old, and excluded several executable, database, virtual-disk, media, temporary, and log file types. ![Sanitized Rclone command recursively copying files from a file-server share to an external SFTP destination using 20 concurrent transfers, an age filter, and file-type exclusions.](https://www.microsoft.com/en-us/security/blog/wp-content/uploads/2026/10/image-19.webp)Figure 7. Sanitized Rclone command used to copy data from a file-server share to an external SFTP destination. The incident demonstrates that partial identity containment can reduce attack activity while still leaving a viable privileged route. ## Case 2: PetitPotam and ESC8 turn a workstation into a domain-controller identity ### PetitPotam coerces domain-controller authentication The ESC1 path used in the first case was not available in this environment. Instead, the attacker used PetitPotam to send requests over the Encrypting File System Remote Protocol (EFSRPC), causing the domain controller to authenticate to an attacker-controlled system using its machine account. The attacker then relayed that NTLM authentication to AD CS Web Enrollment without knowing the domain controller’s password. ![Diagram showing Teams help desk impersonation leading to remote access, PetitPotam authentication coercion, NTLM relay to AD CS Web Enrollment, certificate-based Kerberos authentication, and customer-led workstation isolation.](https://www.microsoft.com/en-us/security/blog/wp-content/uploads/2026/10/image-20.webp)Figure 8. Case 2: Help desk impersonation led to PetitPotam authentication coercion, ESC8 relay to AD CS, certificate-based Kerberos authentication, and customer-led device isolation. ### NTLM relay reaches AD CS Web Enrollment The attacker relayed the domain controller’s NTLM authentication to AD CS Web Enrollment. This technique is known as ESC8. It targets an enrollment web endpoint that accepts NTLM without sufficient relay protection, allowing the attacker to submit a certificate request as the relayed account. The AD CS server authenticated the domain-controller machine account even though the connection originated from another device. That identity-to-source mismatch is a strong investigation pivot: correlate the machine account, source device, Web Enrollment request, Certification Authority (CA) issuance record, and subsequent Kerberos activity. After authenticating to Web Enrollment as the domain controller, the attacker requested and retrieved a certificate using the Domain Controller template. The important service paths are the certificate submission and retrieval endpoints under /certsrv; isolated URL access is not malicious by itself and must be correlated with the authenticated identity, source device, process, and CA request. ![Sanitized view of AD CS Web Enrollment activity involving certificate submission and retrieval through /certsrv, used during ESC8 certificate issuance for a relayed domain-controller identity.](https://www.microsoft.com/en-us/security/blog/wp-content/uploads/2026/10/image-22-1024x307.webp)Figure 9. Sanitized view of AD CS Web Enrollment activity involving certificate submission and retrieval through /certsrv, used during ESC8 certificate issuance for a relayed domain-controller identity. ### Certificate-based Kerberos authentication The attacker used the newly issued domain-controller certificate for Kerberos PKINIT and obtained a ticket-granting ticket (TGT) for the domain controller. This step converted a relayed NTLM authentication into a certificate-backed Kerberos identity. PKINIT success is the response threshold: responders should investigate the requesting device, authenticated account, issued certificate, active Kerberos sessions, and any service-ticket use. Certificate revocation and Kerberos ticket review are separate containment actions. ### Customer-led device isolation and observed outcome Microsoft Defender generated ESC8-related alerts, after which the customer isolated the workstation associated with the certificate-enrollment and Kerberos activity. The documented containment action in this case was customer-led device isolation. No further attack progression was observed following isolation. ## Why the response outcomes differed In Case 1, an exclusion left a compromised privileged account available to the attacker despite disruption of other identities. In Case 2, customer-led device isolation followed Defender alerts, and no further attack progression was observed. | Response element | Case 1: ESC1 | Case 2: ESC8 | | --- | --- | --- | | Response mechanism | Microsoft Defender automated attack disruption targeting compromised identities. | Microsoft Defender alerts followed by customer-led device isolation. | | Measured effect | Covered identities were restricted; more than 1,000 SMB attempts and additional logons were blocked; further DCSync activity was limited. | The workstation associated with certificate enrollment and Kerberos activity was isolated. | | Containment follow-up | One privileged account was excluded from automated response and remained available to the attacker. | No further progression was observed after isolation; | | Observed outcome | The excluded identity was later used for file-server access and data exfiltration. | No subsequent attack progression was documented after customer isolation. | ## Actionable investigation methods The most useful artifacts are not individual commands or ports in isolation. Investigators should reconstruct the chain across collaboration, endpoint, identity, and certificate systems. - **Teams and remote access:** identify the external tenant, user interaction, call or chat timing, remote-session start, approved remote monitoring and management (RMM) process, and child processes created during the session. - **Runtime staging:** inspect newly created KB-prefixed or application-like folders, archive extraction, runtime metadata, script operands, parent-child relationships, and subsequent network activity. - **Directory interaction:** use network data to identify LDAPS and SMB connections, then use endpoint and directory logs to determine what the initiating process did. TLS intentionally hides LDAP query content from passive network inspection. - **ESC1: **review certificate request and issuance events, requester identity, subject and Subject Alternative Names (SAN) values, template name, enrollment permissions, and the first authentication performed with the issued certificate. - **PetitPotam and ESC8:** correlate EFSRPC activity, outbound authentication by the domain controller, the device that relayed the authentication, Web Enrollment access, CA request and issuance records, and PKINIT from the originating workstation. - **Disruption and containment: **enumerate every compromised identity and device, review exclusions before and during response, revoke unauthorized certificates, and assess active Kerberos tickets separately ### Reduce support impersonation and unauthorized remote access - Require users to verify unsolicited support requests through a known internal channel before joining a call, sharing a screen, or starting a remote-control session. - Encourage users to pay attention to warnings in incoming messages and calls when impersonation is detected. - Review Teams external-access and federation policies. Limit external domains to business requirements and investigate newly observed organization-themed or helpdesk-themed tenants in context. - Restrict remote-support software to approved products, operators, and workflows. Alert when approved RMM tools extract archives, create interpreters, or launch scripts from user-writable paths. ### Constrain runtime-based execution - Use App Control for Business or equivalent application control to restrict unapproved portable runtimes and script execution from user-writable locations. - Evaluate file identity through signer, original filename, product metadata, path, parent process, and behavior. A renamed executable can retain legitimate version information. - Test relevant attack surface reduction rules and endpoint protection policies. Do not assume controls for Windows script hosts automatically cover JavaScript executed through Bun or source files launched through Java. ### Harden AD CS against ESC1 and ESC8 - Follow Microsoft’s secure configuration guidance for mitigating NTLM relay against AD CS: [https://support.microsoft.com/help/5005413](https://support.microsoft.com/help/5005413) - Review authentication-capable templates for requester-supplied subject information, broad enrollment permissions, weak issuance requirements, and excessive certificate purpose. Remove unnecessary enrollment rights and require approval where appropriate. - Inventory AD CS Web Enrollment and Certificate Enrollment Web Service endpoints. Remove endpoints that are not required. - Require HTTPS and enforce Extended Protection for Authentication (EPA) on enrollment web endpoints. HTTPS protects confidentiality; EPA provides the channel binding needed to resist NTLM relay. - Disable NTLM on enrollment services where operationally feasible and validate Kerberos-only authentication before broad enforcement. - Use Defender for Identity AD CS security posture assessments to identify ESC1-related template exposure and insecure enrollment Internet Information Services (IIS) endpoints associated with ESC8: [https://learn.microsoft.com/defender-for-identity/security-posture-assessments/certificates](https://learn.microsoft.com/defender-for-identity/security-posture-assessments/certificates) ### Enable certificate auditing and prepare certificate-aware response - Enable the Certification Services advanced audit subcategory for success and failure, and configure the Certification Authority audit filter to record request and issuance activity. - Preserve CA security events, CA database records, IIS or Web Enrollment logs, endpoint process lineage, identity alerts, and Teams interaction records. - If an unauthorized certificate was issued, identify its serial number and thumbprint, revoke it, publish updated revocation information, and confirm that relying systems can obtain the update. - Review certificate-based Kerberos activity and active tickets. Revoking a certificate does not retroactively invalidate TGTs or service tickets that were already issued. - Treat containment exclusions as incident decisions. If an account or device cannot be automatically contained, assign a compensating manual action and verify completion. ### Microsoft Defender XDR detections and disruption Microsoft Defender XDR can connect collaboration, endpoint, identity, certificate, and Kerberos signals. Alert names and availability depend on product configuration and enabled sensors. | Tactic | Observed activity | Microsoft Defender coverage | | --- | --- | --- | | Initial access | External Teams contact impersonates IT support and initiates a remote session. | Microsoft Defender for Cloud Applications / Office 365 – Microsoft Teams chat initiated by a suspicious external user – IT Support Teams Voice phishing following mail bombing activity – A user clicked through to a potentially malicious URL. – A potentially malicious URL click was detected. – Suspicious Teams Chat likely involved in remote management and dangerous commands – Possible Teams phishing affecting more than two users Microsoft Defender for Endpoint – Possible initial access from an emerging threat | | Execution | Bun, or Java runs staged scripts from user-writable paths. | Microsoft Defender for Endpoint – Possible initial access from an emerging threat – Suspicious JavaScript process | | Discovery | Staged runtimes query host configuration and interact with domain infrastructure. | Microsoft Defender for Identity – Possible Active Directory Certificate Services enumeration – Suspicious Active Directory Certificate Services (AD CS) certificate request | | Credential access | ESC1 certificate requests target privileged identities. | Microsoft Defender for Endpoint – Suspicious Domain Controller authentication to Active Directory Certificate Services server Microsoft Defender for Identity – Suspicious Active Directory Certificate Services (AD CS) misconfigured certificate template abuse (ESC1) | | Credential access | Domain-controller NTLM authentication reaches AD CS from another device. | Microsoft Defender for Endpoint – Possible NTLM relay attack | | Credential access | ESC8 Web Enrollment issues a machine certificate after NTLM relay. | Microsoft Defender for Endpoint – Suspicious Active Directory Certificate Services (AD CS) machine certificate issuance abuse (ESC8) | | Credential access | PKINIT succeeds and a TGT is issued. | Microsoft Defender for Identity – Suspicious certificate usage over Kerberos protocol (PKINIT) – Suspected suspicious Kerberos ticket request | | Impact prevention | Compromised identities or devices are restricted during an active incident. | Microsoft Defender for Endpoint – Possible source of DCSync attack Microsoft Defender for Identity – Suspected DCSync attack (replication of directory services) | ### Microsoft Security Copilot Security Copilot can help analysts summarize the Teams-to-remote-access sequence, review staged runtime behavior, correlate certificate alerts with affected identities, and prepare containment tasks. Useful prompts should ask for the initiating device, remote-session context, certificate request, issued identity, PKINIT activity, and any response exclusions. Results depend on connected plugins, permissions, and the evidence available to the incident. ### Threat intelligence reports Microsoft customers can use [Microsoft Defender XDR Threat Analytics](https://security.microsoft.com/threatanalytics3/586e1ed7-8e1a-417c-8b00-f6a039bba926/analystreport?tid=5cb7a29d-8232-4101-bb54-70087a167158) to review relevant reports, related incidents, impacted assets, and recommended actions. Search for Teams support impersonation, portable Bun or Java runtimes, AD CS certificate abuse, NTLM relay, ESC1, ESC8, and certificate-based Kerberos authentication. Campaign-specific report. ### Advanced hunting Use these queries to investigate related activity. Tune time windows and filters for your environment. Matches require investigation. #### Teams external contact and available impersonation signals Use these queries as investigation starting points. Validate field availability and expected values in your tenant, tune for legitimate activity, and correlate matches with incidents rather than treating a single result as proof of compromise. **Teams external contact and available impersonation signals** Find external Teams chats and available impersonation signals. CloudAppEvents | where Timestamp > ago(7d) | where Application == "Microsoft Teams" | where (ActionType == "ChatCreated" and IsExternalUser == true) or ActionType in~ ( "TeamsImpersonationDetected", "SecurityRiskInCallDetected") | order by Timestamp desc **Bun or Java execution from KB-prefixed staging paths** Find Bun or Java running scripts from KB-prefixed AppData folders. DeviceProcessEvents | where Timestamp > ago(7d) | where ProcessVersionInfoOriginalFileName =~ "bun.exe" or FileName in~ ("bun.exe", "java.exe", "javaw.exe") | where ProcessCommandLine contains ".js" or ProcessCommandLine contains ".java" | where FolderPath matches regex @"(?i)\AppData\Roaming\KB[0-9]+\" | order by Timestamp desc **Network activity initiated by the staged runtime** Find network connections initiated by the staged runtime. DeviceNetworkEvents | where Timestamp > ago(7d) | where InitiatingProcessVersionInfoOriginalFileName =~ "bun.exe" or InitiatingProcessFileName in~ ( "bun.exe", "java.exe", "javaw.exe") | where RemotePort in (80, 445, 636, 88) | where InitiatingProcessFolderPath matches regex @"(?i)\AppData\Roaming\KB[0-9]+\" | order by Timestamp desc **Enrollment, relay, and PKINIT alerts with their evidence** Find relay, AD CS, and PKINIT alerts with their related evidence. AlertInfo | where Timestamp > ago(7d) | where Title contains "NTLM relay" or Title contains "Certificate Services" or Title contains "PKINIT" or Title contains "Kerberos ticket request" | join kind=inner ( AlertEvidence | where Timestamp > ago(7d) ) on AlertId ### MITRE ATT&CK techniques observed This threat has exhibited use of the following attack techniques. For standard industry documentation, refer to the MITRE ATT&CK framework. **Initial Access** - [T1566.003 Phishing: Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003/) | Teams messages used for support impersonation. - [T1566.004 Phishing: Spearphishing Voice](https://attack.mitre.org/techniques/T1566/004/) | A Teams call formed part of the social-engineering interaction. **Command and Control** - [T1219 Remote Access Software](https://attack.mitre.org/techniques/T1219/) | An attacker-controlled remote monitoring and management session provided interactive access. **Execution** - [T1059.003 Command and Scripting Interpreter: Windows Command Shell](https://attack.mitre.org/techniques/T1059/003/) | Shell commands staged archives, launched the runtime, and initiated native discovery commands. - [T1059.007 Command and Scripting Interpreter: JavaScript/JScript](https://attack.mitre.org/techniques/T1059/007/) | Bun executed attacker-supplied JavaScript modules. **Defense Evasion** - [T1036 Masquerading](https://attack.mitre.org/techniques/T1036/) | The activity used update-themed staging and a renamed Bun executable. **Discovery** - [T1082 System Information Discovery](https://attack.mitre.org/techniques/T1082/) | The runtime initiated a Windows version registry query. - [T1016 System Network Configuration Discovery](https://attack.mitre.org/techniques/T1016/) | The runtime initiated ipconfig /all. - [T1057 Process Discovery](https://attack.mitre.org/techniques/T1057/) | The runtime initiated tasklist. **Credential Access** - [T1557 Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557/) | Certificate authority telemetry showed a domain-controller identity authenticating from another device, supporting NTLM relay; no name-resolution poisoning was established. - [T1649 Steal or Forge Authentication Certificates](https://attack.mitre.org/techniques/T1649/) | The activity involved abusive machine-certificate issuance through Certificate Services Web Enrollment and subsequent certificate-based authentication. ### Indicators of compromise (IOC) | Indicator | Type | Role | | --- | --- | --- | | 85b6c424117494d3056e88689dbc94c75e9afdb187a339714043aec0da109f17 | SHA-256 | Initial Access Java Script | | f326201269f1ee2f803ae435317507263bb6e0dbfdeb70bd1bb5446e2e46f001 | SHA-256 | Initial Access python script | | 06c5c14f043aee3bcc5843b5f50909623d5c9a6239a7c1fba9cddad4111469e7 | SHA-256 | Initial Access python script | ## References - [Teams security best practices for safer messaging](https://learn.microsoft.com/microsoftteams/teams-security-best-practices-for-safer-messaging). Microsoft Learn (accessed 2026-10-29) - [Microsoft Defender for Office 365 support for Microsoft Teams.](https://learn.microsoft.com/defender-office-365/mdo-support-teams-about) Microsoft Learn (accessed 2026-10-29) - [Application Control for Windows](https://learn.microsoft.com/windows/security/application-security/application-control/app-control-for-business/appcontrol). Microsoft Learn (accessed 2026-10-29) - [Attack surface reduction rules reference](https://learn.microsoft.com/defender-endpoint/attack-surface-reduction-rules-reference). Microsoft Learn (accessed 2026-10-29) - [KB5005413: Mitigating NTLM relay attacks on Active Directory Certificate Services](https://support.microsoft.com/en-us/topic/kb5005413-mitigating-ntlm-relay-attacks-on-active-directory-certificate-services-ad-cs-3612b773-4043-4aa9-b23d-b87910cd3429). Microsoft Support (accessed 2026-10-29) - [Defender for Identity security assessment: Insecure AD CS certificate enrollment IIS endpoints (ESC8)](https://learn.microsoft.com/en-us/defender-for-identity/security-posture-assessments/certificates). Microsoft Learn (accessed 2026-10-29) ## Learn More For the latest security research from the Microsoft Threat Intelligence community, check out the [Microsoft Threat Intelligence Blog](https://aka.ms/threatintelblog). To get notified about new publications and to join discussions on social media, follow us on [LinkedIn](https://www.linkedin.com/showcase/microsoft-threat-intelligence), [X (formerly Twitter)](https://x.com/MsftSecIntel), and [Bluesky](https://bsky.app/profile/threatintel.microsoft.com). To hear stories and insights from the Microsoft Threat Intelligence community about the ever-evolving threat landscape, listen to the [Microsoft Threat Intelligence podcast](https://thecyberwire.com/podcasts/microsoft-threat-intelligence). Review our documentation to learn more about our real-time protection capabilities and see how to enable them within your organization.   - Learn more about [securing Copilot Studio agents with Microsoft Defender](https://learn.microsoft.com/en-us/defender-cloud-apps/ai-agent-protection)  - Evaluate your AI readiness with our latest [Zero Trust for AI workshop](https://microsoft.github.io/zerotrustassessment/). - [Microsoft 365 Copilot AI security documentation](https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-ai-security) - [How Microsoft discovers and mitigates evolving attacks against AI guardrails](https://www.microsoft.com/en-us/security/blog/2024/04/11/how-microsoft-discovers-and-mitigates-evolving-attacks-against-ai-guardrails/) - [Prompt injection protection in Microsoft Defender for Office 365 ](https://learn.microsoft.com/en-us/defender-office-365/step-by-step-guides/prompt-injection-protection-defender-for-office-365)– official documentation of the prompt injection protection in Microsoft Defender for Office 365. - [How Microsoft discovers and mitigates evolving attacks against AI guardrails | Microsoft Security Blog](https://www.microsoft.com/en-us/security/blog/2024/04/11/how-microsoft-discovers-and-mitigates-evolving-attacks-against-ai-guardrails/) - [Manipulating AI memory for profit: The rise of AI Recommendation Poisoning | Microsoft Security Blog](https://www.microsoft.com/en-us/security/blog/2026/02/10/ai-recommendation-poisoning/) – a related example of an AI-era technique observed in email traffic - [Defending the inbox against prompt injection attacks | Microsoft Defender for Office 365 Blog ](https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/defending-the-inbox-against-prompt-injection-attacks/4534636)– feature announcement introducing prompt injection protection in Microsoft Defender for Office 365. - Learn how Microsoft is reimagining the SOC for the agentic era with [ISOC in Microsoft Defender](https://www.microsoft.com/security/blog/2026/09/23/reimagining-the-soc-for-the-agentic-era-in-microsoft-defender/) The post [From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths](https://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/) appeared first on [Microsoft Security Blog](https://www.microsoft.com/en-us/security/blog). --- --- title: "See who has access to your Gmail inbox in 2 minutes." url: "https://blog.google/innovation-and-ai/technology/safety-security/google-security-checkup/" lang: "en-US" type: "post" description: "Run a quick Google Security Checkup and protect your email with three quick and easy steps." last_modified: "2026-10-30T16:00:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://blog.google/innovation-and-ai/technology/safety-security/rss/" wpe_sourcepermalink: "https://blog.google/innovation-and-ai/technology/safety-security/google-security-checkup/" --- # See who has access to your Gmail inbox in 2 minutes. Run a quick Google Security Checkup and protect your email with three quick and easy steps. --- --- title: "California officials confirm grand jury subpoenas as states, civil groups brace to protect elections from federal encroachment" url: "https://cyberscoop.com/california-election-subpoenas-doj-voter-rolls/" lang: "en-US" type: "post" description: "The Trump administration is taking direct aim at California state election officials, issuing grand jury subpoenas to election offices statewide ahead of the final day of voting on Nov. 3. The investigations, first reported by Bloomberg, center on alleged administration" last_modified: "2026-10-30T15:58:35+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://cyberscoop.com/feed/" wpe_sourcepermalink: "https://cyberscoop.com/california-election-subpoenas-doj-voter-rolls/" --- # California officials confirm grand jury subpoenas as states, civil groups brace to protect elections from federal encroachment The Trump administration is taking direct aim at California state election officials, issuing grand jury subpoenas to election offices statewide ahead of the final day of voting on Nov. 3. The investigations, first [reported](https://news.bloomberglaw.com/us-law-week/doj-orders-criminal-probes-of-california-officials-over-ballots) by Bloomberg, center on alleged administration of illegal voting. They are ostensibly tied to demands by the U.S. Justice Department that California and other states use federal voter lists to determine whether a voter is a “potential noncitizen” and should be removed. The Los Angeles County Registrar of Voters told CyberScoop it received multiple grand jury subpoenas last week related to the investigation. The office called the federal efforts an attempt to intimidate California election officials into accepting federal supremacy over state voter registration authority. “At every step, the U.S. Department of Justice has taken a confrontational, adversarial approach,” said Los Angeles County Registrar Dean Logan in a statement. “Election officials are acting in accordance with state and federal law. Clear court rulings at both the U.S. District Court level and the Court of Appeals have confirmed that. Threats and intimidation have no place in elections. We will take whatever steps necessary to ensure the safety of our employees and to remain focused on serving the voters of Los Angeles County so they can exercise their voting franchise.” California Secretary of State Shirley Weber, also reportedly a target of the federal probe, did not respond to a request for comment from CyberScoop. One California election official, Clint Curtis, the outgoing registrar of voters in Shasta County, [endorsed](https://storage.courtlistener.com/recap/gov.uscourts.cacd.1043513/gov.uscourts.cacd.1043513.107.4.pdf) the federal government’s efforts to remove 20,000 voters from California voter rolls. Curtis, whose term ends in January, was previously part of a failed effort to hire Tina Peters, a felon and former Mesa County, Colorado, election clerk to help with the upcoming midterms. Curtis has long believed in widespread election fraud. He [told CyberScoop](https://cyberscoop.com/shasta-county-election-clint-curtis-tina-peters-controversy/) earlier this year that he believed Shasta County elections in 2024 were plagued by suspicious mail-in ballots, saying they looked, felt and “smelled” different from normal mail ballots. The U.S. Constitution gives states the authority to administer elections and Congress the power to make election laws, something courts have repeatedly upheld in dozens of legal challenges by the Trump administration. The Department of Justice has claimed there are at least 20,000 such potential noncitizens on California’s voter lists, while the Department of Homeland Security [told CyberScoop](https://cyberscoop.com/justice-department-california-voter-arrests-noncitizen-claims/) the figure could be as many as 190,000. The administration’s data, drawn from public voter lists, federal databases and commercially purchased personal information, has been repeatedly criticized by election officials, voting experts and federal courts as inaccurate and unreliable for determining voter eligibility. Most people identified as “potential noncitizens” turn out to be naturalized citizens who have since gained voting rights, or the result of state administrative errors that mistakenly registered a small number of ineligible voters. Many of those mistakenly registered never cast a ballot. State officials have had to defend against attempts at federal coercion as well as third-party activists who are constantly testing and probing election procedures nationwide, sometimes without understanding the laws election officials must follow to verify voters. On Wednesday, the Hennepin County Attorney’s Office in Minnesota [announced](https://www.hennepinattorney.org/news/news/2026/October/election-charges) felony charges against a pair of right-wing provocateurs, James O’Keefe and Cam Higby, for unlawful voting and identity theft. According to a statement from Hennepin County Attorney Mary Moriarty, the two showed up at various election offices, provided false identities of real voters to election judges, violating state laws against misrepresenting their identity in applying for a ballot. “Elections are the bedrock of democracy and their protection is one of our highest priorities. Individuals engaging in unlawful conduct related to our elections will be held accountable,” said Moriarty. “Our office has had regular meetings with Hennepin County Elections staff in preparation for both the primary and the general elections this year and we are fully prepared.” Voting rights and civil society groups are also executing short- and long-term plans to combat potential voter disenfranchisement ahead of Tuesday. Jessica Ayoub, deputy political director for the Michigan American Civil Liberties Union, said her organization has “never been more prepared” for any expected fights with the federal government or local officials seeking to disenfranchise voters, saying they first began planning for different scenarios 18 months ago, cultivating relationships with hundreds of clerks and election staff across Michigan. “We’ve gamed out 25 potential scenarios and have rapid response strategies that we’ll deploy to ensure our elections are protected and that our democracy remains intact,” said Ayoub, who cited a desire not to publicize further details ahead of next month. On Friday, voting rights groups filed a new [lawsuit](https://protectdemocracy.org/wp-content/uploads/2026/10/seiu-et-al-v-doj.pdf) against the Department of Justice and Department of Homeland Security in California, seeking to block the federal government’s efforts against state election officials. The groups are asking a judge to declare that the federal government has exceeded its constitutional authority and that state officials are legally carrying out their duties. They also want the court to force the departments to contact all California election officials who received subpoenas and tell them the investigation has halted due to a court order. The post [California officials confirm grand jury subpoenas as states, civil groups brace to protect elections from federal encroachment](https://cyberscoop.com/california-election-subpoenas-doj-voter-rolls/) appeared first on [CyberScoop](https://cyberscoop.com/). --- --- title: "Trezor warns of suspected crypto-theft implant in hardware wallet" url: "https://www.bleepingcomputer.com/news/security/trezor-warns-of-suspected-crypto-theft-implant-in-hardware-wallet/" lang: "en-US" type: "post" description: "Hardware wallet device maker Trezor has received credible reports about a suspected hardware crypto-theft implant in a Trezor Safe 5 sold by its reseller CryptoBilis in Southeast Asia." last_modified: "2026-10-30T15:58:20+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.bleepingcomputer.com/feed/" wpe_sourcepermalink: "https://www.bleepingcomputer.com/news/security/trezor-warns-of-suspected-crypto-theft-implant-in-hardware-wallet/" --- # Trezor warns of suspected crypto-theft implant in hardware wallet Hardware wallet device maker Trezor has received credible reports about a suspected hardware crypto-theft implant in a Trezor Safe 5 sold by its reseller CryptoBilis in Southeast Asia. […] --- --- title: "New Framework Puts Ransomware Resilience for AI Systems in Focus" url: "https://www.infosecurity-magazine.com/news/framework-ransomware-resilience-ai/" lang: "en-US" type: "post" description: "RAID-AI aims to help organizations assess their security preparation for ransomware attacks targeting AI systems" last_modified: "2026-10-30T15:53:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.infosecurity-magazine.com/rss/news/" wpe_sourcepermalink: "https://www.infosecurity-magazine.com/news/framework-ransomware-resilience-ai/" --- # New Framework Puts Ransomware Resilience for AI Systems in Focus RAID-AI aims to help organizations assess their security preparation for ransomware attacks targeting AI systems --- --- title: "L’Italia è afflitta da vulnerabilità informatiche, senza una causa chiara" url: "https://www.darkreading.com/cybersecurity-analytics/cyber-vulnerabilities-besiege-italy-italian" lang: "en-US" type: "post" description: "I ricercatori non riescono a spiegare del tutto perché le minacce informatiche in Italia siano così diverse rispetto a quelle di qualsiasi altro Paese." last_modified: "2026-10-30T15:39:54+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.darkreading.com/rss.xml" wpe_sourcepermalink: "https://www.darkreading.com/cybersecurity-analytics/cyber-vulnerabilities-besiege-italy-italian" --- # L’Italia è afflitta da vulnerabilità informatiche, senza una causa chiara I ricercatori non riescono a spiegare del tutto perché le minacce informatiche in Italia siano così diverse rispetto a quelle di qualsiasi altro Paese. --- --- title: "Fake PDF and search tools hijacked searches for 13.4 million Chrome users" url: "https://www.malwarebytes.com/blog/news/2026/10/fake-pdf-and-search-tools-hijacked-searches-for-13-4-million-chrome-users" lang: "en-US" type: "post" description: "Ads promoted browser extensions as tools to find manuals, convert PDFs, or make searches safer. But many of these extensions sent users’ search queries through servers controlled by their operators.Socket researcher John Tuckner identified 319 extensions with an estimated 13.4" last_modified: "2026-10-30T15:25:41+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.malwarebytes.com/blog/feed/index.xml" wpe_sourcepermalink: "https://www.malwarebytes.com/blog/news/2026/10/fake-pdf-and-search-tools-hijacked-searches-for-13-4-million-chrome-users" --- # Fake PDF and search tools hijacked searches for 13.4 million Chrome users Ads promoted browser extensions as tools to find manuals, convert PDFs, or make searches safer. But many of these extensions sent users’ search queries through servers controlled by their operators. [Socket](https://socket.dev/blog/searchjacked) researcher John Tuckner identified 319 extensions with an estimated 13.4 million installs over a decade. The extensions hijacked users’ default search settings and routed their searches through servers controlled by the operators before sending them to Yahoo or Bing. This gave the operators access to users’ queries and let them earn referral payments. Socket says the extensions were promoted through ads on networks including Google Ads, promoting tools such as “manual finders,” “PDF converters,” “safe search,” and “AI search.” The extensions were listed in Google’s official store, but most were unlisted. That means people with a direct link could visit a listing and install an extension, while ordinary searches in the store would not show it. An ad offered help with an immediate task, a landing page encouraged installation, and the official store provided a familiar place to complete it. ## Search hijacking The main risk was that operators could see what users searched for. Searches can reveal health worries, financial problems, workplace interests, or other personal matters. Socket says queries were often associated with a unique identifier, which could let the operators link a user’s searches over time. The proxy could also choose where to send a search. Socket says this could potentially direct users to [phishing](https://www.malwarebytes.com/phishing) or malware pages, but it did not find evidence that the extensions had done so. ## What should users do? If your searches start going astray, or you installed a search, PDF-converter, manual-finder, or security extension after clicking an ad, check what’s installed. - **Review your extensions. **Enter `chrome://extensions` in Chrome’s address bar. Remove extensions you don’t recognize, no longer use, or don’t trust. To remove one, select **Remove** and confirm. If you’re unsure about an extension, check it against the list at the end of [Socket’s blog](https://socket.dev/blog/searchjacked). - **Check your search settings.** In Chrome, at the top right, select **More **(the three-dot menu), then **Settings** > **Search engine.** If Chrome says an extension is controlling a setting, review or remove that extension. The absence of this notice doesn’t confirm that all your extensions are safe. - **Run a [Malwarebytes scan](https://www.malwarebytes.com/solutions/virus-scanner)** to check for malicious extensions and other malware that could be affecting your device. **From reporting threats to removing them.** Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by [downloading Malwarebytes today](https://www.malwarebytes.com/for-home). --- --- title: "Unauthorized Codex and Claude Code Relays Disable Security Protections at 12 Organizations" url: "https://gbhackers.com/codex-claude-code-relays/" lang: "en-US" type: "post" description: "Symantec’s Threat Hunter Team has found an unauthorized relay service that installs the genuine OpenAI Codex and Anthropic Claude Code CLIs, then rewrites their settings to turn off sandboxing. It has affected 12 organizations since early 2026, mostly in mainland" last_modified: "2026-10-30T15:23:20+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://gbhackers.com/feed/" wpe_sourcepermalink: "https://gbhackers.com/codex-claude-code-relays/" --- # Unauthorized Codex and Claude Code Relays Disable Security Protections at 12 Organizations Symantec’s Threat Hunter Team has found an unauthorized relay service that installs the genuine OpenAI Codex and Anthropic Claude Code CLIs, then rewrites their settings to turn off sandboxing. It has affected 12 organizations since early 2026, mostly in mainland China. Codex Claude Code relays AI coding agents read files, write code, and run commands […] The post [Unauthorized Codex and Claude Code Relays Disable Security Protections at 12 Organizations](https://gbhackers.com/codex-claude-code-relays/) appeared first on [GBHackers Security | #1 Globally Trusted Cyber Security News Platform](https://gbhackers.com/). --- --- title: "TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them" url: "https://thehackernews.com/2026/10/teamviewer-flaw-lets-remote-computers.html" lang: "en-US" type: "post" description: "TeamViewer has fixed a flaw that lets the machine being controlled in a remote session attack the computer that connected to control it. In a TeamViewer session, the computer that connects and takes control is the viewer, and the machine" last_modified: "2026-10-30T15:17:28+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://feeds.feedburner.com/TheHackersNews?format=xml" wpe_sourcepermalink: "https://thehackernews.com/2026/10/teamviewer-flaw-lets-remote-computers.html" --- # TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them TeamViewer has fixed a flaw that lets the machine being controlled in a remote session attack the computer that connected to control it. In a TeamViewer session, the computer that connects and takes control is the viewer, and the machine it controls is the host. A malicious or compromised host can exploit the flaw to crash the viewer’s TeamViewer and, depending on the platform, may also run --- --- title: "Defense contractor pleads guilty to aiding North Korean remote worker scheme" url: "https://cyberscoop.com/defense-contractor-guilty-north-korea-scheme-facilitator/" lang: "en-US" type: "post" description: "A defense contractor with top secret security clearance pleaded guilty to aiding North Korea’s remote worker scheme by allowing co-conspirators to use his identity to apply for jobs, including positions with national security implications, the Justice Department said Wednesday.  John" last_modified: "2026-10-30T15:14:29+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://cyberscoop.com/feed/" wpe_sourcepermalink: "https://cyberscoop.com/defense-contractor-guilty-north-korea-scheme-facilitator/" --- # Defense contractor pleads guilty to aiding North Korean remote worker scheme A defense contractor with top secret security clearance pleaded guilty to aiding North Korea’s remote worker scheme by allowing co-conspirators to use his identity to apply for jobs, including positions with national security implications, the [Justice Department](https://www.justice.gov/usao-edva/pr/defense-contractor-employee-pleads-guilty-aiding-north-korean-remote-it-scheme) said Wednesday.  John Allen Kurrle Jr. participated in a short-lived but prolific conspiracy that spanned at least 88 job applications at U.S.-based companies, resulting in nine job offers, according to court records. The 62-year-old allowed co-conspirators to use his identity and government clearance for prospective sensitive work, often with U.S. government contractors. The nine job offers Kurrle’s co-conspirators received between June and October 2025 had annual salary ranges of $120,000 to $190,000. The scheme had a limited success rate. The longest and most lucrative job a co-conspirator landed under Kurrle’s identity lasted about three weeks, netting a total pay of $4,800. His identity was also used to gain employment as a software engineer at a Ventura, California-based company to work on a generative AI project for a component of the U.S. military. The company sent a laptop to Kurrle’s residence in Gainesville, Virginia, where he received and hosted laptops shipped by multiple victim companies, enabling co-conspirators to remotely access the devices from outside the United States. Yet, during a video call to verify employment eligibility, the company noticed that the person who appeared on the video call did not match Kurrle’s age or physical characteristics, according to court records. The unnamed company terminated the employment of Kurrle’s co-conspirator before he did any work on the military contract and Kurrle shipped the laptop back to the company.  The company paid Kurrle’s co-conspirator almost $2,200 for 32 hours of onboarding, which Kurrle is now ordered to pay in restitution along with the $4,800 received from the other company.  Kurrle also, as part of his plea agreement, admitted to using the identity of a third person, without their consent, to apply for some remote work positions. He doesn’t dispute that the scheme likely benefitted North Korea, but claims he wasn’t aware of the connections to North Korea during the duration of his involvement in the conspiracy. Michael Barnhart, nation state investigator at DTEX, said researchers previously identified Kurrle as a facilitator for North Korea’s remote worker scheme. Yet, until recently, he wasn’t sure if Kurrle was a victim or impersonated.  The case underscores North Korea’s efforts to gain access to roles with a strategic intelligence requirement, as it focuses on contractor roles because those present the path of least resistance. Kurrle joins a growing list of people who have been charged or jailed for supporting the North Korea regime’s scheme that generates hundreds of millions of dollars annually for the country’s military and organizations involved in its weapons programs. Authorities have been cracking down on the malicious insider activity by seizing cryptocurrency linked to the theft, and targeting U.S.-based facilitators who provided forged or stolen identities and hosted laptop farms for North Korean operatives.  Some of that money is also funneling through a web of front companies and intermediaries, including sanctioned entities, that partly fund Russia’s war effort against Ukraine, DTEX said in a report in July. This includes manufacturing weapons and supplying them to Russia’s military, according to the security firm. The countermeasures are stacking up, but the scheme is widespread and has infiltrated an undetermined number of businesses, including hundreds of [Fortune 500 companies](https://cyberscoop.com/north-korea-workers-infiltrate-fortune-500/). Federal judges previously sentenced other people to prison for their involvement in the scheme, including [Matthew Issac Knoot and Erick Ntekereze Prince](https://cyberscoop.com/north-korea-it-worker-scheme-laptop-farm-facilitators-sentenced/); [Keija Wang and Zhenxing Wang](https://cyberscoop.com/us-nationals-sentenced-facilitate-north-korea-tech-worker-scheme/); [Audricus Phagnasay, Jason Salazar and Alexander Paul Travis](https://cyberscoop.com/north-korea-it-worker-scheme-three-sentenced/); [Oleksandr Didenko](https://cyberscoop.com/doj-ukrainian-north-korea-remote-worker-scheme-facilitator-sentenced/) and [Christina Chapman](https://cyberscoop.com/arizona-woman-arrested-and-charged-in-north-korean-it-worker-scheme/).  Kurrle pleaded guilty to conspiracy to commit wire fraud and faces up to 20 years in prison upon sentencing, which is currently scheduled for Jan. 28, 2027. The post [Defense contractor pleads guilty to aiding North Korean remote worker scheme](https://cyberscoop.com/defense-contractor-guilty-north-korea-scheme-facilitator/) appeared first on [CyberScoop](https://cyberscoop.com/). --- --- title: "Japan Faces Growing Cyberattack Crisis as AI Tools Help Hackers Target Businesses and Government" url: "https://gbhackers.com/japan-ai-cyberattacks/" lang: "en-US" type: "post" description: "Japan is dealing with an intense wave of AI-assisted intrusions that has exposed weaknesses in its corporate and public-sector defenses. Dozens of incidents, from brokerages to delivery firms, have made data leaks routine. Japan AI cyberattacks According to reporting published" last_modified: "2026-10-30T15:13:24+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://gbhackers.com/feed/" wpe_sourcepermalink: "https://gbhackers.com/japan-ai-cyberattacks/" --- # Japan Faces Growing Cyberattack Crisis as AI Tools Help Hackers Target Businesses and Government Japan is dealing with an intense wave of AI-assisted intrusions that has exposed weaknesses in its corporate and public-sector defenses. Dozens of incidents, from brokerages to delivery firms, have made data leaks routine. Japan AI cyberattacks According to reporting published by Bloomberg, on October 28, Japan’s Ministry of Economy, Trade and Industry (METI) disclosed unauthorized […] The post [Japan Faces Growing Cyberattack Crisis as AI Tools Help Hackers Target Businesses and Government](https://gbhackers.com/japan-ai-cyberattacks/) appeared first on [GBHackers Security | #1 Globally Trusted Cyber Security News Platform](https://gbhackers.com/). --- --- title: "Claude Builds Five Exploit Chains Targeting Chrome, Safari, Windows, and Linux" url: "https://www.esecurityplanet.com/threats/news-claude-exploit-chains-chrome-linux-android/" lang: "en-US" type: "post" description: "Anthropic's Claude built exploit chains against Chrome, Safari, Windows, and Linux, and extracted files from a locked Pixel 9 during controlled security tests." last_modified: "2026-10-30T15:09:17+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.esecurityplanet.com/feed/" wpe_sourcepermalink: "https://www.esecurityplanet.com/threats/news-claude-exploit-chains-chrome-linux-android/" --- # Claude Builds Five Exploit Chains Targeting Chrome, Safari, Windows, and Linux Anthropic’s Claude built exploit chains against Chrome, Safari, Windows, and Linux, and extracted files from a locked Pixel 9 during controlled security tests. --- --- title: "Hackers Target Asian Governments With New NetamLoader Malware Hidden in Windows Update Files" url: "https://gbhackers.com/netamloader-malware/" lang: "en-US" type: "post" description: "Kaspersky researchers have uncovered NetamLoader, a .NET loading framework built on XAML markup. It appears to be a supply-chain attack on a customized Windows build used only by Asian government bodies. No known APT group has been linked to it." last_modified: "2026-10-30T15:02:50+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://gbhackers.com/feed/" wpe_sourcepermalink: "https://gbhackers.com/netamloader-malware/" --- # Hackers Target Asian Governments With New NetamLoader Malware Hidden in Windows Update Files Kaspersky researchers have uncovered NetamLoader, a .NET loading framework built on XAML markup. It appears to be a supply-chain attack on a customized Windows build used only by Asian government bodies. No known APT group has been linked to it. NetamLoader malware Kaspersky Security Network flagged a .config file that used AppDomainManager injection to load […] The post [Hackers Target Asian Governments With New NetamLoader Malware Hidden in Windows Update Files](https://gbhackers.com/netamloader-malware/) appeared first on [GBHackers Security | #1 Globally Trusted Cyber Security News Platform](https://gbhackers.com/). --- --- title: "Operationalizing CISA AA26-194A: Automating Cisco Router Security Assessments with Qualys Policy Audit" url: "https://blog.qualys.com/product-tech/2026/10/30/cisa-aa26-194a-cisco-router-policy-audit" lang: "en-US" type: "post" description: "Key Takeaways CISA AA26-194A provides actionable guidance to improve the security of Internet-facing Cisco routers against real-world attack techniques. The advisory focuses on configuration hardening and security hygiene, rather than a single vulnerability or CVE. Manually validating advisory recommendations across" last_modified: "2026-10-30T15:00:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://blog.qualys.com/feed/atom" wpe_sourcepermalink: "https://blog.qualys.com/product-tech/2026/10/30/cisa-aa26-194a-cisco-router-policy-audit" --- # Operationalizing CISA AA26-194A: Automating Cisco Router Security Assessments with Qualys Policy Audit --- #### Key Takeaways - CISA AA26-194A provides actionable guidance to improve the security of Internet-facing Cisco routers against real-world attack techniques. - The advisory focuses on configuration hardening and security hygiene, rather than a single vulnerability or CVE. - Manually validating advisory recommendations across enterprise networks is difficult, time-consuming, and prone to inconsistencies. - Qualys Policy Audit transforms advisory guidance into automated configuration compliance checks, enabling organizations to continuously assess Cisco router configurations. --- Organizations can quickly identify configuration gaps, prioritize remediation, and continuously measure compliance using an out-of-the-box assessment policy. Cybersecurity advisories provide valuable guidance for defending against evolving threats, but their true value lies in how quickly organizations can translate recommendations into measurable security controls. With the release of the **[CISA Joint Cybersecurity Advisory AA26-194A](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-194a)**, security teams now have concrete guidance to strengthen the security posture of their Internet-facing Cisco routers. With **[Qualys Policy Audit](https://www.qualys.com/apps/policy-audit)**, organizations can automate configuration assessments to operationalize these crucial recommendations. It is crucial to acknowledge that actors sponsored by the Russian state are actively exploiting misconfigured and vulnerable networking devices, such as Cisco routers, to penetrate enterprise and critical infrastructure networks. This access enables them to move deeper into these environments without detection. In response, CISA, the NSA, and international partners have published AA26-194A, which provides clear guidance on hardening these devices against these threats.  Organizations must understand that the guidance isn’t the hard part; the real challenge lies in ensuring that every router in production adheres to it. This is the gap where most organizations struggle. Addressing that gap requires ongoing compliance verification rather than a one-time assessment. It is important to start assessing your Cisco routers in accordance with the advisory’s recommendations. ## Understanding CISA AA26-194A CISA is committed to enhancing cybersecurity and regularly publishes periodically Joint Cybersecurity Advisories in collaboration with the National Security Agency (NSA) and other international partners. AA26-194A, titled _Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting_, delivers crucial insights based on real-world threat intelligence, incident response findings, and observed attacker techniques. This advisory shows that attackers exploit weak configurations, legacy management protocols, insecure administrative access, and unsupported devices to infiltrate enterprise networks.  It is crucial to implement the advisory’s recommendations, which focus on fundamental security practices. These include using the Simple Network Management Protocol (SNMP), restricting management access, disabling unnecessary services, removing insecure default configurations, maintaining updated software versions, and continuously monitoring network device configurations. Taking these steps is essential for ensuring robust network security and resilience against potential threats. Routers are the frontline defense systems exposed to the internet, making them crucial in safeguarding enterprise networks. A single insecure configuration can enable attackers to establish persistence, intercept traffic, or move laterally within the environment. Even organizations with mature vulnerability management programs often overlook configuration weaknesses, which attackers frequently exploit. The recommendations in AA26-194A help close this configuration gap by guiding organizations toward secure practices that strengthen the security posture of their Cisco network devices. For organizations managing hundreds or thousands of Cisco devices, manually reviewing configurations is impractical, and a lack of visibility can slow remediation. Addressing it should be a priority. ## The Operational Challenge Understanding a security advisory may seem straightforward, but assessing whether hundreds or even thousands of network devices comply with that guidance is a formidable challenge. Many security teams are stuck relying on manual Command-Line Interface (CLI) reviews, spreadsheets, or custom scripts, which not only consume valuable time but also increase the likelihood of inconsistent assessments and make ongoing compliance monitoring difficult to sustain. Organizations need a robust solution that turns advisory recommendations into continuous, repeatable, and measurable compliance checks. ## Transforming Guidance into Continuous Compliance Qualys Policy Audit decisively addresses the challenges organizations face with AA26-194A by providing an out-of-the-box policy that automates the assessment of Cisco router configurations against the advisory’s recommended security practices. Built on the core principle of continuous visibility into every control, this platform harnesses AI-powered risk-based prioritization, ensures automated remediation with audit-ready evidence by default, and strengthens identity and access governance  to eliminate ownership gaps, all while mapping compliance across more than 100 frameworks. [![](https://blog.qualys.com/wp-content/uploads/2026/10/image-17-1-1070x481.png)](https://blog.qualys.com/wp-content/uploads/2026/10/image-17-1.png) Instead of engaging in painstaking manual reviews of each configuration, security teams  receive  a real-time  of their Cisco network infrastructure. Non-compliant devices are swiftly identified  automatically, and remediation efforts areprioritized based on actionable compliance results. The policy rigorously automates the validation of critical security recommendations from the advisory, including secure SNMP configuration, hardened management services and remote administration, stronger password and authentication controls, restricted management access, software lifecycle and support validation, and essential additional hardening practices for Cisco routers. [![](https://blog.qualys.com/wp-content/uploads/2026/10/Policy.jpg)](https://blog.qualys.com/wp-content/uploads/2026/10/Policy.jpg) ## Benefits of Automated Assessment With Qualys Policy Audit, organizations can: - Assess Cisco router configurations against CISA guidance on a recurring schedule. - Identify insecure configurations before attackers can exploit them. - Reduce the manual effort needed to respond to newly published advisories. - Prioritize remediation by risk, so resources go where they matter most. - Demonstrate alignment with recommended security practices through audit-ready compliance reporting. - Detect configuration drift between assessments rather than relying on a one-time check. _Qualys states that Policy Audit can cut manual compliance tasks by up to 90% through automated evidence collection and reporting._ [![](https://blog.qualys.com/wp-content/uploads/2026/10/PA-clean-maindashboard-1.png)](https://blog.qualys.com/wp-content/uploads/2026/10/PA-clean-maindashboard-1.png) ## **Conclusion** Cybersecurity advisories offer critical security guidance, but relying solely on guidance will not enhance security. Organizations must actively measure, validate, and continuously monitor the implementation of these recommendations to ensure effectiveness. With the out-of-the-box CISA AA26-194A policy in Qualys Policy Audit, security teams can automate Cisco router configuration assessments. This enables them to swiftly identify configuration weaknesses and significantly strengthen their network security posture through ongoing compliance monitoring. As organizations face increasingly complex network environments, automating configuration assessments is not just beneficial but essential for turning security guidance into measurable, repeatable security outcomes. **See the AA26-194A policy in action. Explore Qualys Policy Audit or request a walkthrough to see automated Cisco router compliance for yourself.** [Start Your Free Trial](https://www.qualys.com/forms/policy-audit/) ## **Frequently Asked Questions (FAQs)** ### **What is CISA AA26-194A?** A joint cybersecurity advisory published July 13, 2026, titled Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting. It describes FSB Center 16’s exploitation of poorly configured networking devices and lists hardening steps. ### **Is this about a single CVE?** No. The primary path is configuration hygiene, especially SNMP and management access. Actors also use Cisco Smart Install and known CVEs such as CVE-2018-0171 and CVE-2008-4128. ### **What does the Qualys policy check?** Cisco router configurations against the advisory’s recommended practices: SNMP, management services, password and authentication controls, restricted management access, software lifecycle, and additional hardening. ### **Does Policy Audit replace the advisory**? No. It operationalizes the technical configuration recommendations so teams can assess them continuously. Network design, monitoring, and incident response stay with the organization. ### **What should I do first?** Disable Cisco Smart Install, move to SNMPv3 with authPriv, restrict management protocols to an out-of-band network, and confirm unsupported devices are scheduled for replacement. Then use continuous assessment so the check does not stop at the first review. --- --- title: "AI-Accelerated Attacks, Major Breaches, and Critical Flaws Define the Week" url: "https://www.esecurityplanet.com/weekly-roundup/ai-accelerated-attacks-major-breaches-and-critical-flaws-define-the-week/" lang: "en-US" type: "post" description: "Weekly summary of Cybersecurity Insider newsletters" last_modified: "2026-10-30T14:54:02+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.esecurityplanet.com/feed/" wpe_sourcepermalink: "https://www.esecurityplanet.com/weekly-roundup/ai-accelerated-attacks-major-breaches-and-critical-flaws-define-the-week/" --- # AI-Accelerated Attacks, Major Breaches, and Critical Flaws Define the Week Weekly summary of Cybersecurity Insider newsletters --- --- title: "Malicious Claude Code extension on Cursor planted SSH backdoors" url: "https://www.bleepingcomputer.com/news/security/malicious-claude-code-extension-on-cursor-planted-ssh-backdoors/" lang: "en-US" type: "post" description: "A malicious version of Anthropic's Claude Code VS Code extension was distributed through Cursor's extension marketplace for approximately 11 hours on October 29, exposing up to 5,000 developers to malware designed to install persistent SSH backdoors." last_modified: "2026-10-30T14:36:54+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.bleepingcomputer.com/feed/" wpe_sourcepermalink: "https://www.bleepingcomputer.com/news/security/malicious-claude-code-extension-on-cursor-planted-ssh-backdoors/" --- # Malicious Claude Code extension on Cursor planted SSH backdoors A malicious version of Anthropic’s Claude Code VS Code extension was distributed through Cursor’s extension marketplace for approximately 11 hours on October 29, exposing up to 5,000 developers to malware designed to install persistent SSH backdoors. […] --- --- title: "The Wild Rise of a Trump-Backed Drone Company" url: "https://www.wsj.com/business/the-wild-rise-of-a-trump-backed-drone-company-6722ac08?mod=rss_Technology" lang: "en-US" type: "post" description: "Ex-soldier Brett Velicovich turned a presidential social media shout-out into a $300 million drone startup." last_modified: "2026-10-30T14:36:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://feeds.content.dowjones.io/public/rss/RSSWSJD" wpe_sourcepermalink: "https://www.wsj.com/business/the-wild-rise-of-a-trump-backed-drone-company-6722ac08?mod=rss_Technology" --- # The Wild Rise of a Trump-Backed Drone Company Ex-soldier Brett Velicovich turned a presidential social media shout-out into a $300 million drone startup. --- --- title: "Hackers Use Cursor and Claude AI to Automate Attacks in Aur0ra Ransomware Operations" url: "https://gbhackers.com/aur0ra-ransomware-ai-attacks/" lang: "en-US" type: "post" description: "The GOLD OGRE cybercrime group is using AI coding agents, including Cursor and Anthropic’s Claude, to automate intrusions for Aur0ra ransomware (Aurora). Sophos researchers say the agents moved from credential access to domain administrator with little human involvement. Aur0ra ransomware" last_modified: "2026-10-30T14:35:49+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://gbhackers.com/feed/" wpe_sourcepermalink: "https://gbhackers.com/aur0ra-ransomware-ai-attacks/" --- # Hackers Use Cursor and Claude AI to Automate Attacks in Aur0ra Ransomware Operations The GOLD OGRE cybercrime group is using AI coding agents, including Cursor and Anthropic’s Claude, to automate intrusions for Aur0ra ransomware (Aurora). Sophos researchers say the agents moved from credential access to domain administrator with little human involvement. Aur0ra ransomware AI attacks In May 2026, Sophos Counter Threat Unit (CTU) researchers reported an AI-assisted post-exploitation […] The post [Hackers Use Cursor and Claude AI to Automate Attacks in Aur0ra Ransomware Operations](https://gbhackers.com/aur0ra-ransomware-ai-attacks/) appeared first on [GBHackers Security | #1 Globally Trusted Cyber Security News Platform](https://gbhackers.com/). --- --- title: "Syrian hacker who served Assad regime gets 42 months in US prison" url: "https://cyberscoop.com/syrian-hacker-ahmad-umar-agha-sentenced/" lang: "en-US" type: "post" description: "A Syrian man who prosecutors say was a central figure in a hacking operation run from former President Bashar Assad’s inner circle was sentenced Thursday to 42 months in federal prison. Ahmad Umar Agha, 42, carried out the conspiracy from" last_modified: "2026-10-30T14:33:22+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://cyberscoop.com/feed/" wpe_sourcepermalink: "https://cyberscoop.com/syrian-hacker-ahmad-umar-agha-sentenced/" --- # Syrian hacker who served Assad regime gets 42 months in US prison A Syrian man who prosecutors say was a central figure in a hacking operation run from former President Bashar Assad’s inner circle was sentenced Thursday to 42 months in federal prison. Ahmad Umar Agha, 42, carried out the conspiracy from as early as Aug. 24, 2011, until Jan. 31, 2024, according to the Justice Department. The operation was organized and led by members of Assad’s circle, including the commander of Syria’s General Intelligence Directorate. Agha hacked approximately 47 media entities, businesses, nongovernmental organizations and U.S. and allied government bodies, prosecutors said. The motives included punishing news organizations for reporting on Syrian government atrocities during the Arab Spring and the civil war that followed, spreading fear and confusion among the regime’s opponents, collecting intelligence and trying to persuade members of the U.S. military to refuse their orders. “Agha deployed his hacking skills in the service of Assad’s regime to silence reporting on the regime’s atrocities, intimidate its opponents, and incite U.S. servicemembers to refuse their orders,” said Assistant Attorney General for National Security John A. Eisenberg. The most damaging intrusion came April 23, 2013. Prosecutors said Agha accessed the Twitter account belonging to the Associated Press to post a false claim that President Barack Obama had been injured in two explosions at the White House. The post [triggered a flash crash](https://apnews.com/general-news-68a43f18c9aa4a87bfbf350a566404c9), briefly erasing $136 billion in value from the stock market.  In another intrusion, Agha, who used the hacker handle, “Th3 Pr0,” compromised the company hosting the U.S. Marine Corps’ recruitment website and redirected about 3,500 visitors to an image urging Marines to refuse their orders and fight alongside the Syrian Army. On two occasions, he stole usernames and passwords for White House staff email accounts in attempts to take control of the White House’s social media accounts. In one instance he succeeded, prosecutors said. The costs to victims were significant. One company that works with online publishers lost about $35,000 a day for roughly six months. A global nongovernmental organization spent about $250,000 on new network monitoring products, retrained more than 800 staff members and suffered $480,000 in total losses. “This case emphasizes the grave threat posed by cyber criminals and especially those serving regimes hostile to the United States,” said First Assistant U.S. Attorney Theophani K. Stamos for the Eastern District of Virginia. Agha and coconspirator Firas Dardar were first charged by criminal complaint June 12, 2014, and indicted May 17, 2018. Dardar remains a fugitive. He was also charged [in 2015 in a separate conspiracy](https://fedscoop.com/syrian-electronic-army-justice-department-computer-hacking-conspiracy/) alongside Peter Romar, a Syrian national then living in Germany, that involved computer intrusion, extortion, money laundering and violations of the Syrian Sanctions Regulations. Romar was extradited from Germany and pleaded guilty in 2016. Assad’s regime collapsed in December 2024, and the former president fled the country. The post [Syrian hacker who served Assad regime gets 42 months in US prison](https://cyberscoop.com/syrian-hacker-ahmad-umar-agha-sentenced/) appeared first on [CyberScoop](https://cyberscoop.com/). --- --- title: "Fake GitHub Repo Tricks AI Agents Into Installing SolanaCry Malware" url: "https://hackread.com/fake-github-repo-ai-coding-agents-solanacry-malware/" lang: "en-US" type: "post" description: "A fake GitHub repository tricks AI coding agents into installing SolanaCry malware, giving attackers remote access to developers’ Windows PCs through NetSupport." last_modified: "2026-10-30T14:12:28+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://hackread.com/feed/" wpe_sourcepermalink: "https://hackread.com/fake-github-repo-ai-coding-agents-solanacry-malware/" --- # Fake GitHub Repo Tricks AI Agents Into Installing SolanaCry Malware A fake GitHub repository tricks AI coding agents into installing SolanaCry malware, giving attackers remote access to developers’ Windows PCs through NetSupport. --- --- title: "NCSC-2026-0463 [1.00] [M/H] Kwetsbaarheid verholpen in Cisco Secure Firewall ASA en FTD Software" url: "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0463" lang: "en-US" type: "post" description: "Cisco heeft een ernstige kwetsbaarheid verholpen in Cisco Secure Firewall Adaptive Security Appliance (ASA) en Cisco Secure Firewall Threat Defense (FTD). Cisco bevestigt dat de kwetsbaarheid actief wordt misbruikt. Deze kwetsbaarheid met kenmerk CVE-2026-76418 heeft een CVSS-score van 8.6 en" last_modified: "2026-10-30T14:11:44+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://advisories.ncsc.nl/rss/advisories" wpe_sourcepermalink: "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0463" --- # NCSC-2026-0463 [1.00] [M/H] Kwetsbaarheid verholpen in Cisco Secure Firewall ASA en FTD Software Cisco heeft een ernstige kwetsbaarheid verholpen in Cisco Secure Firewall Adaptive Security Appliance (ASA) en Cisco Secure Firewall Threat Defense (FTD). Cisco bevestigt dat de kwetsbaarheid actief wordt misbruikt. Deze kwetsbaarheid met kenmerk CVE-2026-76418 heeft een CVSS-score van 8.6 en bevindt zich in de Remote Access SSL VPN-functionaliteit. Een niet-geauthenticeerde kwaadwillende kan de kwetsbaarheid op afstand misbruiken door een speciaal vervaardigd verzoek naar de VPN-dienst te versturen. Hierdoor kan het getroffen apparaat onverwacht herstarten, wat kan leiden tot een Denial-of-Service (DoS) en verstoring van de dienstverlening. Voor succesvol misbruik moet de SSL VPN-dienst bereikbaar zijn en secundaire authenticatie zijn geconfigureerd voor een VPN-tunnelgroep. Een succesvolle VPN-aanmelding is niet vereist. --- --- title: "Undead Software Projects Continue to Raise Security Risks" url: "https://www.darkreading.com/application-security/undead-software-projects-raise-security-risks" lang: "en-US" type: "post" description: "A security firm patched a decade-old app to prevent the takeover of millions of machines, highlighting that abandoned domains remain a boon to attackers." last_modified: "2026-10-30T14:10:37+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.darkreading.com/rss.xml" wpe_sourcepermalink: "https://www.darkreading.com/application-security/undead-software-projects-raise-security-risks" --- # Undead Software Projects Continue to Raise Security Risks A security firm patched a decade-old app to prevent the takeover of millions of machines, highlighting that abandoned domains remain a boon to attackers. --- --- title: "WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours" url: "https://thehackernews.com/2026/10/wordpress-rce-flaw-draws-nearly-63000.html" lang: "en-US" type: "post" description: "Threat actors have been observed attempting to exploit a high-severity security flaw in WordPress Core shortly after patches were released. The vulnerability, which does not have a CVE identifier, relates to a case of remote code execution impacting WordPress Core" last_modified: "2026-10-30T14:08:14+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://feeds.feedburner.com/TheHackersNews?format=xml" wpe_sourcepermalink: "https://thehackernews.com/2026/10/wordpress-rce-flaw-draws-nearly-63000.html" --- # WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours Threat actors have been observed attempting to exploit a high-severity security flaw in WordPress Core shortly after patches were released. The vulnerability, which does not have a CVE identifier, relates to a case of remote code execution impacting WordPress Core versions 4.7 through 7.1.3. It carries a CVSS score of 8.1 on the CVSS scoring system. Patches for the flaw were released on October --- --- title: "SS7 and Diameter Attacks: How Signaling Flaws Expose Your Phone" url: "https://www.bleepingcomputer.com/news/security/ss7-and-diameter-attacks-how-signaling-flaws-expose-your-phone/" lang: "en-US" type: "post" description: "Flaws in SS7 and Diameter signaling protocols can allow attackers to track phone locations, intercept calls and SMS verification codes, and impersonate subscribers without compromising their devices. Cape explains how these attacks exploit trust between networks and how its security-focused" last_modified: "2026-10-30T14:00:10+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.bleepingcomputer.com/feed/" wpe_sourcepermalink: "https://www.bleepingcomputer.com/news/security/ss7-and-diameter-attacks-how-signaling-flaws-expose-your-phone/" --- # SS7 and Diameter Attacks: How Signaling Flaws Expose Your Phone Flaws in SS7 and Diameter signaling protocols can allow attackers to track phone locations, intercept calls and SMS verification codes, and impersonate subscribers without compromising their devices. Cape explains how these attacks exploit trust between networks and how its security-focused mobile service helps defend against them. […] --- --- title: "CVE-2026-70125 Microsoft Office Outlook Remote Code Execution Vulnerability" url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70125" lang: "en-US" type: "post" description: "Updated one or more CVSS scores for the affected products. This is an informational change only." last_modified: "2026-10-30T14:00:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://api.msrc.microsoft.com/update-guide/rss" wpe_sourcepermalink: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70125" --- # CVE-2026-70125 Microsoft Office Outlook Remote Code Execution Vulnerability Updated one or more CVSS scores for the affected products. This is an informational change only. --- --- title: "CVE-2026-69446 Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability" url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69446" lang: "en-US" type: "post" description: "Corrected CVE by adding the assigning CNA. This is an informational change only." last_modified: "2026-10-30T14:00:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://api.msrc.microsoft.com/update-guide/rss" wpe_sourcepermalink: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69446" --- # CVE-2026-69446 Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability Corrected CVE by adding the assigning CNA. This is an informational change only. --- --- title: "CVE-2026-118147 Visual Studio Spoofing Vulnerability" url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118147" lang: "en-US" type: "post" description: "Improper certificate validation in Visual Studio allows an unauthorized attacker to perform spoofing over a network." last_modified: "2026-10-30T14:00:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://api.msrc.microsoft.com/update-guide/rss" wpe_sourcepermalink: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118147" --- # CVE-2026-118147 Visual Studio Spoofing Vulnerability Improper certificate validation in Visual Studio allows an unauthorized attacker to perform spoofing over a network. --- --- title: "“A Ring Tone That I Cannot Hear” – Twenty Years Later" url: "https://blog.didierstevens.com/2026/10/30/a-ring-tone-that-i-cannot-hear-twenty-years-later/" lang: "en-US" type: "post" description: "My first post for this blog was in June 2006, 20 years ago: A Ring Tone That I Cannot Hear. Back then, I tested my hearing with Audacity, and I could hear a tone up to 14 kHz. 20 years" last_modified: "2026-10-30T13:50:46+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://blog.didierstevens.com/feed/" wpe_sourcepermalink: "https://blog.didierstevens.com/2026/10/30/a-ring-tone-that-i-cannot-hear-twenty-years-later/" --- # “A Ring Tone That I Cannot Hear” – Twenty Years Later My first post for this blog was in June 2006, 20 years ago: [A Ring Tone That I Cannot Hear](https://blog.didierstevens.com/2006/06/13/a-ring-tone-that-i-cannot-hear/). Back then, I tested my hearing with Audacity, and I could hear a tone up to 14 kHz. 20 years later, I do the test again, and I can hear a tone up to 8 kHz. It’s no surprise that my hearing declined over the years, that happens to everybody. What did surprise me, or better said, what impressed me, is that a free and open-source tool like [Audacity](https://www.audacityteam.org/) still exists after 20 years, and that I can just issue the exact same commands as 20 years ago! --- --- title: "NCSC-2026-0462 [1.00] [M/H] Kwetsbaarheden verholpen in Juniper Networks Session Smart Router en Session Smart Conductor" url: "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0462" lang: "en-US" type: "post" description: "Juniper heeft meerdere kwetsbaarheden verholpen in Juniper Networks Session Smart Router en Session Smart Conductor. De kwetsbaarheden betreffen verschillende componenten van de Juniper Networks Session Smart Router en Session Smart Conductor. - Er zijn out-of-bounds read- en write-fouten in HTTP-parser," last_modified: "2026-10-30T13:15:45+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://advisories.ncsc.nl/rss/advisories" wpe_sourcepermalink: "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0462" --- # NCSC-2026-0462 [1.00] [M/H] Kwetsbaarheden verholpen in Juniper Networks Session Smart Router en Session Smart Conductor Juniper heeft meerdere kwetsbaarheden verholpen in Juniper Networks Session Smart Router en Session Smart Conductor. De kwetsbaarheden betreffen verschillende componenten van de Juniper Networks Session Smart Router en Session Smart Conductor. – Er zijn out-of-bounds read- en write-fouten in HTTP-parser, TCP proxy, TCP header verwerking en VRRPv3 packet verwerking, die kunnen leiden tot service crashes, geheugenbeschadiging, sessie desynchronisatie en mogelijke informatielekken. – Een improper initialisatieprobleem in de beveiligingspolicy kan leiden tot het gebruik van onjuiste encryptiesleutels, wat decryptie van netwerkverkeer of denial of service kan veroorzaken. – Verder kunnen lokale aanvallers door speciaal vervaardigde directorynamen onbedoeld bestanden unmounten tijdens service cleanup, wat de beschikbaarheid beïnvloedt. – Ongeauthenticeerde API endpoints maken het mogelijk voor lokale niet-geprivilegieerde gebruikers om als root willekeurige bestanden te overschrijven. – Onvoldoende verificatie van data-integriteit in de model cache directory kan leiden tot het uitvoeren van willekeurige code en privilege escalatie. – In de AccessManager module is er een OS command injection mogelijk via ongeldige invoer bij het verwijderen van auditregels, wat ook het verwijderen van bestanden mogelijk maakt. – Onjuiste bestandspermissies in de RoutingManager module van Session Smart Conductor kunnen lokale gebruikers toegang geven tot gevoelige routinggegevens. – Ongefilterde invoer in request body parameters maakt HTTP response splitting mogelijk. – De AutomatedProvisioner van Session Smart Conductor bevat een kwetsbaarheid die ongeauthenticeerde remote command execution als root toestaat via speciaal vervaardigde salt minion IDs. – In de ConfigDirector component kunnen geauthenticeerde REST gebruikers via ongesaniteerde invoer in certificaat- en private key API’s willekeurige bestandsoperaties uitvoeren, waaronder lezen, overschrijven en verwijderen. – Een stack buffer overflow in de DHCP client van Session Smart Router kan leiden tot remote code execution. – Een onbeveiligde interne endpoint in Session Smart Router maakt het mogelijk voor ongeauthenticeerde aanvallers om administratieve privileges te verkrijgen. – Een integer overflow in de Deep Packet Inspection certificate scanner kan een denial of service veroorzaken bij het inspecteren van TLS certificaten. – Een integer underflow in de DhcpMessageDecoder kan leiden tot informatielekken en service crashes. – Tenslotte kunnen in de AccessManager component met config-write rechten OS command injection en privilege escalatie plaatsvinden door onvoldoende validatie en neutralisatie van invoer in YANG configuraties. --- --- title: "Enterprise AI Is on the Ballot Too" url: "https://www.wsj.com/cio-journal/enterprise-ai-is-on-the-ballot-too-36cdf06d?mod=rss_Technology" lang: "en-US" type: "post" description: "Plus, Mistral releases ‘Le Chonk;’ the cloud delivers (again)" last_modified: "2026-10-30T13:09:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://feeds.content.dowjones.io/public/rss/RSSWSJD" wpe_sourcepermalink: "https://www.wsj.com/cio-journal/enterprise-ai-is-on-the-ballot-too-36cdf06d?mod=rss_Technology" --- # Enterprise AI Is on the Ballot Too Plus, Mistral releases ‘Le Chonk;’ the cloud delivers (again) --- --- title: "Why Retired IT Assets Are One of the Most Overlooked Cybersecurity Threats" url: "https://secureblitz.com/retired-it-assets-cybersecurity-risks/" lang: "en-US" type: "post" description: "In this post, you will learn why retired IT assets are one of the most overlooked cybersecurity threats. Typical cybersecurity that most organizations think of includes cloud security, firewalls, phishing attacks, and ransomware. Most investment and attention go toward protecting" last_modified: "2026-10-30T13:05:02+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://secureblitz.com/feed/" wpe_sourcepermalink: "https://secureblitz.com/retired-it-assets-cybersecurity-risks/" --- # Why Retired IT Assets Are One of the Most Overlooked Cybersecurity Threats In this post, you will learn why retired IT assets are one of the most overlooked cybersecurity threats. Typical cybersecurity that most organizations think of includes cloud security, firewalls, phishing attacks, and ransomware. Most investment and attention go toward protecting systems that are active and connected to the network. Yet there is a critical blind […] The post [Why Retired IT Assets Are One of the Most Overlooked Cybersecurity Threats](https://secureblitz.com/retired-it-assets-cybersecurity-risks/) appeared first on [SecureBlitz Cybersecurity](https://secureblitz.com/). --- --- title: "Assad regime hacker who caused $136 billion market drop sentenced to 42 months" url: "https://www.helpnetsecurity.com/2026/10/30/syrian-hacker-sentenced-42-months-prison/" lang: "en-US" type: "post" description: "A Syrian man who used a hijacked news agency Twitter account to post a fake report of explosions at the White House has been sentenced to 42 months in prison, the US Department of Justice has announced. Ahmad Umar Agha," last_modified: "2026-10-30T13:00:40+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.helpnetsecurity.com/feed/" wpe_sourcepermalink: "https://www.helpnetsecurity.com/2026/10/30/syrian-hacker-sentenced-42-months-prison/" --- # Assad regime hacker who caused $136 billion market drop sentenced to 42 months A Syrian man who used a hijacked news agency Twitter account to post a fake report of explosions at the White House has been sentenced to 42 months in prison, the US Department of Justice has announced. Ahmad Umar Agha, also known as “Th3Pr0”, was sentenced on Thursday by a federal court in the Eastern District of Virginia for his central role in a hacking conspiracy organized and led by members of former Syrian President … [More →](https://www.helpnetsecurity.com/2026/10/30/syrian-hacker-sentenced-42-months-prison/) The post [Assad regime hacker who caused $136 billion market drop sentenced to 42 months](https://www.helpnetsecurity.com/2026/10/30/syrian-hacker-sentenced-42-months-prison/) appeared first on [Help Net Security](https://www.helpnetsecurity.com/). --- --- title: "CISA says max severity GitLab flaw now exploited in the wild" url: "https://www.bleepingcomputer.com/news/security/hackers-now-exploiting-max-severity-gitlab-flaw-in-attacks/" lang: "en-US" type: "post" description: "Attackers have started exploiting a maximum-severity GitLab vulnerability patched earlier this month, according to the US Cybersecurity and Infrastructure Security Agency (CISA)." last_modified: "2026-10-30T13:00:32+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.bleepingcomputer.com/feed/" wpe_sourcepermalink: "https://www.bleepingcomputer.com/news/security/hackers-now-exploiting-max-severity-gitlab-flaw-in-attacks/" --- # CISA says max severity GitLab flaw now exploited in the wild Attackers have started exploiting a maximum-severity GitLab vulnerability patched earlier this month, according to the US Cybersecurity and Infrastructure Security Agency (CISA). […] --- --- title: "Photo ID, bank checks, face scan? The UK’s age-check options" url: "https://www.malwarebytes.com/blog/news/2026/10/photo-id-bank-checks-face-scan-the-uks-age-check-options" lang: "en-US" type: "post" description: "As preparation for the UK’s planned social media ban, Ofcom has set out four ways social media platforms could check whether users are aged 16 or over. The government and Parliament will decide how the ban works in practice. Ofcom" last_modified: "2026-10-30T13:00:02+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.malwarebytes.com/blog/feed/index.xml" wpe_sourcepermalink: "https://www.malwarebytes.com/blog/news/2026/10/photo-id-bank-checks-face-scan-the-uks-age-check-options" --- # Photo ID, bank checks, face scan? The UK’s age-check options As preparation for the UK’s planned social media ban, Ofcom has set out four ways social media platforms could check whether users are aged 16 or over. The government and Parliament will decide how the ban works in practice. Ofcom is the regulator for the communications services in the UK. The [BBC reports](https://www.bbc.com/news/articles/c6ly3027820lo) that Ofcom identified four ways to check someone’s age that it considers “highly effective.” Here’s what those checks would involve: - **Photo ID matching**: Comparing a live image of you with the photo on an identity document, such as your passport, and checking the age information on that document. - **Bank-based checks:** Using age information your bank already holds about you, with your consent. - **Facial age estimation**: Using technology to estimate your age from your face. Ofcom says this technology has improved recently. - **Digital ID services**: Using a digital identity service to prove your age, rather than presenting a physical document. Let’s think through what those checks could mean. ## Challenges The challenge isn’t simply checking someone’s age. It’s doing so without turning everyday internet use into an identity check. Photo ID matching brings highly sensitive documents and facial images into the process, which raises questions about how that information is handled and protected. The risks aren’t hypothetical: as [I reported last year](https://www.malwarebytes.com/blog/news/2025/12/in-2025-age-checks-started-locking-people-out-of-the-internet), a breach at a third-party support provider for Discord exposed government ID images belonging to around 70,000 users. Banking-based checks can be more privacy-preserving if they return only confirmation that someone meets the age threshold, rather than exposing financial information. But the important questions are what information each party receives, what gets retained, and whether the check can be linked to someone’s activity. Facial age estimation can avoid uploading an identity document, but it still processes a sensitive image and makes an imperfect prediction. [Ofcom acknowledges](https://www.ofcom.org.uk/online-safety/protecting-children/how-age-checks-at-age-16-can-work-to-underpin-uks-social-media-ban) that some technologies can be wrong by a few years around age 16, so people near the threshold may face an additional verification check. I would expect these checks to stop some underage access but not eliminate it. Previous restrictions have been followed by workarounds, including [increased VPN use](https://www.malwarebytes.com/blog/news/2025/06/pornhub-redtube-and-youporn-block-access-in-france-vpn-use-set-to-soar), borrowed credentials, and migration to services outside the restrictions. The danger is treating a successful age gate as proof that children are now safe, when it might push them into less regulated spaces. The effectiveness depends on how the checks are implemented. A [VPN](https://www.malwarebytes.com/vpn) may help someone avoid a check triggered by their apparent location; it won’t, by itself, bypass an identity or facial check that is still required. Similarly, Ofcom says matching a live image to an ID is intended to make it harder to borrow someone else’s document. We shouldn’t assume every workaround defeats every method. But Ofcom accepts that some motivated children will get through. The meaningful test is how much harm these measures prevent, weighed against the privacy risks and barriers they introduce— not whether every user has completed a check. My personal preference is double-blind verification: a provider confirms that you meet the age requirement without learning which service you’re accessing, while the service receives proof of age without learning your identity. Proving you’re old enough shouldn’t mean revealing who you are. **Scammers don’t need to hack you. They just need you to click once.**  [Malwarebytes Identity Theft Protection](https://www.malwarebytes.com/identity-theft-protection) catches suspicious activity before it becomes a problem. --- --- title: "Shufti ties AI agent actions to verified owners and permissions" url: "https://www.helpnetsecurity.com/2026/10/30/shufti-know-your-agent-kya/" lang: "en-US" type: "post" description: "Shufti launches Know Your Agent (KYA), an AI agent verification solution designed to verify autonomous AI agents acting on behalf of individuals and businesses. Agentic commerce enables AI agents to open accounts, place orders, and move funds for their owners." last_modified: "2026-10-30T12:53:33+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.helpnetsecurity.com/feed/" wpe_sourcepermalink: "https://www.helpnetsecurity.com/2026/10/30/shufti-know-your-agent-kya/" --- # Shufti ties AI agent actions to verified owners and permissions Shufti launches Know Your Agent (KYA), an AI agent verification solution designed to verify autonomous AI agents acting on behalf of individuals and businesses. Agentic commerce enables AI agents to open accounts, place orders, and move funds for their owners. A business receiving one of these requests needs to know whether the agent is genuine, who is accountable for it, and whether the action falls within what that person approved. A valid access token alone … [More →](https://www.helpnetsecurity.com/2026/10/30/shufti-know-your-agent-kya/) The post [Shufti ties AI agent actions to verified owners and permissions](https://www.helpnetsecurity.com/2026/10/30/shufti-know-your-agent-kya/) appeared first on [Help Net Security](https://www.helpnetsecurity.com/). --- --- title: "Bedrock Data routes data exposure fixes to owners and verifies results" url: "https://www.helpnetsecurity.com/2026/10/30/bedrock-data-ai-assisted-remediation/" lang: "en-US" type: "post" description: "Bedrock Data has announced AI-assisted remediation, which federates the work of fixing data exposure to the data owners across the enterprise. Bedrock Data discovers who owns each exposed dataset, opens a ticket for that owner in the Jira or ServiceNow" last_modified: "2026-10-30T12:39:09+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.helpnetsecurity.com/feed/" wpe_sourcepermalink: "https://www.helpnetsecurity.com/2026/10/30/bedrock-data-ai-assisted-remediation/" --- # Bedrock Data routes data exposure fixes to owners and verifies results Bedrock Data has announced AI-assisted remediation, which federates the work of fixing data exposure to the data owners across the enterprise. Bedrock Data discovers who owns each exposed dataset, opens a ticket for that owner in the Jira or ServiceNow workflow the enterprise already runs and supplies the context needed to fix it. When the owner closes the ticket, Bedrock Data validates that the exposure is remediated and reopens the ticket if it is not. … [More →](https://www.helpnetsecurity.com/2026/10/30/bedrock-data-ai-assisted-remediation/) The post [Bedrock Data routes data exposure fixes to owners and verifies results](https://www.helpnetsecurity.com/2026/10/30/bedrock-data-ai-assisted-remediation/) appeared first on [Help Net Security](https://www.helpnetsecurity.com/). --- --- title: "Are Smartwatches Safe From Cyber Attacks?" url: "https://secureblitz.com/are-smartwatches-safe-from-cyber-attacks/" lang: "en-US" type: "post" description: "This post will answer the question – are smartwatches safe from cyber-attacks? An advanced smartwatch allows the user to access the web easily. It is also viewed as a lifeline item because it helps you stay in touch when you" last_modified: "2026-10-30T12:37:55+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://secureblitz.com/feed/" wpe_sourcepermalink: "https://secureblitz.com/are-smartwatches-safe-from-cyber-attacks/" --- # Are Smartwatches Safe From Cyber Attacks? This post will answer the question – are smartwatches safe from cyber-attacks? An advanced smartwatch allows the user to access the web easily. It is also viewed as a lifeline item because it helps you stay in touch when you need it, even if you have lost your telephone. Unlike the conventional Rolex watch, several […] The post [Are Smartwatches Safe From Cyber Attacks?](https://secureblitz.com/are-smartwatches-safe-from-cyber-attacks/) appeared first on [SecureBlitz Cybersecurity](https://secureblitz.com/). --- --- title: "Trezor Warns of Suspected Spy Implant That Could Steal Crypto Wallet Recovery Phrases" url: "https://gbhackers.com/trezor-warns-of-suspected-spy-implant/" lang: "en-US" type: "post" description: "Trezor has issued an urgent warning after receiving a credible report of a suspected hardware implant in a Safe 5 cryptocurrency wallet purchased from the former reseller CryptoBilis. The company has not independently verified the device, and so far, no" last_modified: "2026-10-30T12:35:20+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://gbhackers.com/feed/" wpe_sourcepermalink: "https://gbhackers.com/trezor-warns-of-suspected-spy-implant/" --- # Trezor Warns of Suspected Spy Implant That Could Steal Crypto Wallet Recovery Phrases Trezor has issued an urgent warning after receiving a credible report of a suspected hardware implant in a Safe 5 cryptocurrency wallet purchased from the former reseller CryptoBilis. The company has not independently verified the device, and so far, no CryptoBilis customers have reported losing funds to Trezor. According to Trezor’s security advisory, the wallet […] The post [Trezor Warns of Suspected Spy Implant That Could Steal Crypto Wallet Recovery Phrases](https://gbhackers.com/trezor-warns-of-suspected-spy-implant/) appeared first on [GBHackers Security | #1 Globally Trusted Cyber Security News Platform](https://gbhackers.com/). --- --- title: "Anthropic AI model finds Linux kernel bug that leads to remote root access" url: "https://www.csoonline.com/article/4242724/anthropic-ai-model-finds-linux-kernel-bug-that-leads-to-remote-root-access.html" lang: "en-US" type: "post" description: "Linux servers running Multipath TCP (MPTCP) could be vulnerable to remote code execution through a flaw in the kernel’s networking stack. Anthropic has disclosed a zero-click exploit developed with an unreleased Claude research model that allows an unauthenticated attacker to" last_modified: "2026-10-30T12:27:11+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.csoonline.com/feed/" wpe_sourcepermalink: "https://www.csoonline.com/article/4242724/anthropic-ai-model-finds-linux-kernel-bug-that-leads-to-remote-root-access.html" --- # Anthropic AI model finds Linux kernel bug that leads to remote root access Linux servers running Multipath TCP (MPTCP) could be vulnerable to remote code execution through a flaw in the kernel’s networking stack. Anthropic has disclosed a zero-click exploit developed with an unreleased Claude research model that allows an unauthenticated attacker to execute arbitrary commands as root, without requiring any user interaction. Tracked as [CVE-2026-98432](https://linuxcvetracker.com/cve/CVE-2026-98432/), the vulnerability is a race-condition-induced use-after-free (UAF) bug in the Linux kernel. Anthropic demonstrated how an attacker could exploit the flaw remotely to leak kernel memory, defeat Kernel Address Space Layout Randomization (KASLR), hijack kernel control flow, and ultimately execute an attacker-controlled shell command. The research is part of Anthropic’s broader effort to evaluate AI models’ ability to discover and exploit vulnerabilities in widely deployed software. The company disclosed five exploit chains involving Chrome, Safari, Android, Windows, and Linux to demonstrate how its internal model could combine multiple weaknesses into functional attacks. Anthropic’s proof of concept for the [Linux exploit](https://www.csoonline.com/article/4236460/linux-kernel-gets-a-fix-for-a-flaw-that-enabled-attackers-to-escape-vms.html) took approximately 53 minutes to progress from the initial memory leak to successful root-level command execution, the company said in a [blog post](https://docs.kernel.org/networking/mptcp.html). ## A TCP connection race leaves kernel memory exposed According to a Linux kernel CVE [advisory](https://www.cve.org/CVERecord?id=CVE-2026-98432), the underlying flaw involves how Linux manages IP options during IPv4 [TCP](https://www.csoonline.com/article/574303/tcp-floods-are-again-the-leading-ddos-attack-vector.html) connection establishment. When a new connection is created, the kernel can transfer ownership of IP options from a pending connection request to the newly created socket without making a separate copy. The problem arises when another CPU is simultaneously processing a retransmitted connection request and using those same options to construct a synchronize-acknowledge (SYNACK) response. If the child socket is freed before the second CPU finishes accessing the options, the kernel can end up reading memory that has already been released. This creates a use-after-free condition. The upstream fix addresses the memory-management problem by deferring the release of the affected objects until after a read-copy-update (RCU) grace period, giving concurrent readers time to finish accessing them. The flaw received a critical severity score of 9.8 and affects eight Linux kernel branches, dating back to version 4.4. Fixed releases include 5.10.272, 5.15.223, 6.6.159, 6.1.190, 6.12.113, 6.18.56, 7.2.10 and 7.3-rc7. For users who obtain Linux through distributions such as Debian, Oracle Linux, SUSE, and Amazon Linux, fixed kernel packages are available for at least some releases. Ubuntu and Red Hat Enterprise Linux, however, had yet to release patched kernels as of October 30. ## MCTCP listeners create the remote attack surface Anthropic’s exploit specifically targets Linux servers running an [MPTCP](https://docs.kernel.org/networking/mptcp.html) listener. MPTCP extends conventional TCP by allowing a device to use multiple network interfaces simultaneously within a single connection. This enables bandwidth aggregation, improved network selection, and failover when one network path becomes unavailable. Linux implements MPTCP through its networking stack, but the protocol is opt-in: applications must explicitly request it when creating sockets, although mechanisms such as eBPF and other configuration techniques can also force applications to use it. Administrators are advised to review their kernel versions, apply the relevant security updates, and assess whether their systems expose MPTCP listeners. --- --- title: "The Importance Of Cybersecurity In Business" url: "https://secureblitz.com/importance-of-cybersecurity-in-business/" lang: "en-US" type: "post" description: "This post will show you the importance of cybersecurity in business. The multiplication of digital technologies and stages – from the cloud, social media, and mobility to the Internet of Things, smart devices, and beyond – is creating new security" last_modified: "2026-10-30T12:25:58+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://secureblitz.com/feed/" wpe_sourcepermalink: "https://secureblitz.com/importance-of-cybersecurity-in-business/" --- # The Importance Of Cybersecurity In Business This post will show you the importance of cybersecurity in business. The multiplication of digital technologies and stages – from the cloud, social media, and mobility to the Internet of Things, smart devices, and beyond – is creating new security threats and extraordinary dangers for executives as organizations change into digitally empowered ventures. Be that […] The post [The Importance Of Cybersecurity In Business](https://secureblitz.com/importance-of-cybersecurity-in-business/) appeared first on [SecureBlitz Cybersecurity](https://secureblitz.com/). --- --- title: "5 Elements To Include In A Comprehensive Cybersecurity Plan" url: "https://secureblitz.com/elements-comprehensive-cybersecurity-plan/" lang: "en-US" type: "post" description: "Want to create a comprehensive cybersecurity plan? Read on! Cybersecurity threats are increasing at an alarming rate. The worldwide cybercrime incidents exceeded 31,000 cases last year. Also, the global number of data breaches with confirmed data loss reached 3950 in" last_modified: "2026-10-30T12:25:34+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://secureblitz.com/feed/" wpe_sourcepermalink: "https://secureblitz.com/elements-comprehensive-cybersecurity-plan/" --- # 5 Elements To Include In A Comprehensive Cybersecurity Plan Want to create a comprehensive cybersecurity plan? Read on! Cybersecurity threats are increasing at an alarming rate. The worldwide cybercrime incidents exceeded 31,000 cases last year. Also, the global number of data breaches with confirmed data loss reached 3950 in 2019.  Organizations must adopt robust cybersecurity measures to protect their business network from cyber-attacks and […] The post [5 Elements To Include In A Comprehensive Cybersecurity Plan](https://secureblitz.com/elements-comprehensive-cybersecurity-plan/) appeared first on [SecureBlitz Cybersecurity](https://secureblitz.com/). --- --- title: "Binance hit by largest-ever crypto theft, with $6.3 billion stolen" url: "https://www.malwarebytes.com/blog/news/2026/10/binance-hit-by-largest-ever-crypto-theft-with-6-3-billion-stolen" lang: "en-US" type: "post" description: ".kadence-column482616_9de20c-07 > .kt-inside-inner-col{padding-top:20px;padding-right:20px;padding-bottom:10px;padding-left:20px;}.kadence-column482616_9de20c-07 > .kt-inside-inner-col{column-gap:var(--global-kb-gap-sm, 1rem);}.kadence-column482616_9de20c-07 > .kt-inside-inner-col{flex-direction:column;}.kadence-column482616_9de20c-07 > .kt-inside-inner-col > .aligncenter{width:100%;}.kadence-column482616_9de20c-07 > .kt-inside-inner-col{background-color:#ffe5e5;}.kadence-column482616_9de20c-07 > .kt-inside-inner-col:before{opacity:0.3;}.kadence-column482616_9de20c-07{position:relative;}@media all and (max-width: 1024px){.kadence-column482616_9de20c-07 > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}@media all and (max-width: 767px){.kadence-column482616_9de20c-07 > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}In this articleAttackers stole $6.3 billion from the Binance cryptocurrency exchangeBinance says user" last_modified: "2026-10-30T12:24:19+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.malwarebytes.com/blog/feed/index.xml" wpe_sourcepermalink: "https://www.malwarebytes.com/blog/news/2026/10/binance-hit-by-largest-ever-crypto-theft-with-6-3-billion-stolen" --- # Binance hit by largest-ever crypto theft, with $6.3 billion stolen .kadence-column482616_9de20c-07 > .kt-inside-inner-col{padding-top:20px;padding-right:20px;padding-bottom:10px;padding-left:20px;}.kadence-column482616_9de20c-07 > .kt-inside-inner-col{column-gap:var(–global-kb-gap-sm, 1rem);}.kadence-column482616_9de20c-07 > .kt-inside-inner-col{flex-direction:column;}.kadence-column482616_9de20c-07 > .kt-inside-inner-col > .aligncenter{width:100%;}.kadence-column482616_9de20c-07 > .kt-inside-inner-col{background-color:#ffe5e5;}.kadence-column482616_9de20c-07 > .kt-inside-inner-col:before{opacity:0.3;}.kadence-column482616_9de20c-07{position:relative;}@media all and (max-width: 1024px){.kadence-column482616_9de20c-07 > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}@media all and (max-width: 767px){.kadence-column482616_9de20c-07 > .kt-inside-inner-col{flex-direction:column;justify-content:center;}} ## **In this article** - Attackers stole $6.3 billion from the Binance [cryptocurrency](https://www.malwarebytes.com/cryptocurrency) exchange - Binance says user funds are safe, but watch out for fake support or recovery offers from scammers - Users should check their accounts and use official Binance channels. [Binance says](https://x.com/binance/status/2115993361517891592) a security incident affected approximately $6.3 billion in cryptocurrency. Its initial investigation points to a compromised DevOps engineer’s laptop as a possible entry point. The exchange says it has frozen around $3 billion with help from [blockchain](https://www.malwarebytes.com/blockchain-what-is-it-and-how-does-it-work) partners. It has promised to cover all losses using its emergency fund and company funds. Binance is [reportedly](https://www.bbc.com/news/articles/cwg7xp8kx4v5o) the largest cryptocurrency exchange by daily trading volume. ## What happened? In an update on October 30, Binance said attackers may have used a compromised laptop belonging to a DevOps engineer to access a service container and submit unauthorized withdrawal transactions. The company said: > “We have found no evidence of any wallet private key leak.” This doesn’t mean that one employee could simply transfer billions of dollars. Binance co-CEO Richard Teng told [BleepingComputer](https://www.bleepingcomputer.com/news/security/binance-links-63-billion-crypto-theft-to-compromised-devops-laptop/) the attacker did not simply use one engineer’s permissions. The incident involved a more complex process, rather than a single “one-click” action. Binance also said investigators had identified additional breach points. Blockchain intelligence firms TRM Labs and Chainalysis have linked the theft to TraderTraitor, a North Korean hacking group associated with previous cryptocurrency thefts. TRM Labs estimates that about $6.36 billion left Binance wallets across ten blockchains, with most of it moving within about 20 minutes. ## What should Binance users do? Binance says approximately $3 billion has been frozen on-chain, while blockchain analysts have reported somewhat different totals. For now, those figures should be treated as developing estimates rather than a final accounting of recovered funds or the exchange’s ultimate losses. **Binance.com** users (**Binance.US** was not affected) should check their accounts, avoid follow-up scams, and respond quickly if they spot signs of a separate compromise. - **Go directly to official updates. **Open the Binance app or navigate to its support site yourself. Avoid logging in through unexpected messages claiming that you must urgently verify your account or claim compensation. Binance has asked customers to rely on official channels. - **Review your account and report anything unexpected. **Check your transaction history and account security settings. If you find activity you do not recognize, contact Binance through its [official support service](https://www.binance.com/en/support/). Binance’s support center includes options to disable an account and reset a password or two-factor authentication. - **Never give anyone your authentication codes. **Treat requests for login codes as a warning sign, even if the person claims to be helping with the incident. - **Be wary of anyone [promising to recover](https://www.malwarebytes.com/blog/news/2026/07/dont-trust-that-fbi-agent-in-your-dms) cryptocurrency. **The [FBI published a warning in 2023](https://www.fbi.gov/contact-us/field-offices/elpaso/news/fbi-tech-tuesday-building-a-defense-against-cryptocurrency-recovery-scams) that fake recovery services target people who have already lost cryptocurrency. - **Preserve evidence if you lose money to a related scam. **Keep messages, wallet addresses, transaction details, and information about anyone offering recovery services. **Pro tip:** Unsure whether a message is a scam? [Check it with Malwarebytes’ Scam Guard](https://my.malwarebytes.com/public/scam-guard) for an assessment and advice on what to do next. ![Link Checker](https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/src/url-lookup/dist/assets/security-lock-Bqsc5uIS.svg) ### Unsure where a link goes? We’ll check it. [Check now](https://www.malwarebytes.com/scam-check/link) --- --- title: "Trezor Warns of Suspected Hardware Implant in One of Its Wallets Sold by CryptoBilis" url: "https://thehackernews.com/2026/10/trezor-warns-of-suspected-hardware.html" lang: "en-US" type: "post" description: "A Trezor Safe 5 hardware wallet bought from the reseller CryptoBilis has an extra circuit board that sends out the recovery phrase over a mobile network, a customer has reported. Trezor has not yet examined the device. It is telling" last_modified: "2026-10-30T12:21:56+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://feeds.feedburner.com/TheHackersNews?format=xml" wpe_sourcepermalink: "https://thehackernews.com/2026/10/trezor-warns-of-suspected-hardware.html" --- # Trezor Warns of Suspected Hardware Implant in One of Its Wallets Sold by CryptoBilis A Trezor Safe 5 hardware wallet bought from the reseller CryptoBilis has an extra circuit board that sends out the recovery phrase over a mobile network, a customer has reported. Trezor has not yet examined the device. It is telling everyone who bought a Trezor from CryptoBilis since March 2026 to move their funds to a new wallet with a new recovery phrase. Trezor said in a blog post  --- --- title: "CISA Confirms Active Exploitation of GitLab Vulnerability CVE-2026-97229" url: "https://gbhackers.com/cisa-gitlab-vulnerability-cve-2026-97229/" lang: "en-US" type: "post" description: "The Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that CVE-2026-97229, a critical vulnerability affecting both GitLab Community Edition and Enterprise Edition, is actively being exploited. On October 29, 2026, CISA added this flaw to its Known Exploited Vulnerabilities catalog," last_modified: "2026-10-30T12:21:27+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://gbhackers.com/feed/" wpe_sourcepermalink: "https://gbhackers.com/cisa-gitlab-vulnerability-cve-2026-97229/" --- # CISA Confirms Active Exploitation of GitLab Vulnerability CVE-2026-97229 The Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that CVE-2026-97229, a critical vulnerability affecting both GitLab Community Edition and Enterprise Edition, is actively being exploited. On October 29, 2026, CISA added this flaw to its Known Exploited Vulnerabilities catalog, increasing the urgency for organizations running affected servers to take action. This vulnerability allows unauthenticated […] The post [CISA Confirms Active Exploitation of GitLab Vulnerability CVE-2026-97229](https://gbhackers.com/cisa-gitlab-vulnerability-cve-2026-97229/) appeared first on [GBHackers Security | #1 Globally Trusted Cyber Security News Platform](https://gbhackers.com/). --- --- title: "Gbyte Recovery Review: The Ultimate No-Backup WhatsApp Recovery Solution" url: "https://secureblitz.com/gbyte-recovery-review/" lang: "en-US" type: "post" description: "Read our 2026 Gbyte Recovery Review. Discover how this tool helps you recover deleted WhatsApp messages without backup. Few things feel as gut-wrenching as opening WhatsApp only to realize an important chat—or worse, an entire thread—has vanished. Whether it’s a" last_modified: "2026-10-30T12:17:30+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://secureblitz.com/feed/" wpe_sourcepermalink: "https://secureblitz.com/gbyte-recovery-review/" --- # Gbyte Recovery Review: The Ultimate No-Backup WhatsApp Recovery Solution Read our 2026 Gbyte Recovery Review. Discover how this tool helps you recover deleted WhatsApp messages without backup. Few things feel as gut-wrenching as opening WhatsApp only to realize an important chat—or worse, an entire thread—has vanished. Whether it’s a heartfelt voice note, critical business exchange, or simply those daily memories that matter more than […] The post [Gbyte Recovery Review: The Ultimate No-Backup WhatsApp Recovery Solution](https://secureblitz.com/gbyte-recovery-review/) appeared first on [SecureBlitz Cybersecurity](https://secureblitz.com/). --- --- title: "The Ultimate VPN Guide – What Is A VPN?" url: "https://secureblitz.com/ultimate-vpn-guide-what-is-a-vpn/" lang: "en-US" type: "post" description: "Did you hear about a VPN and don’t know what it means and how it works, so you’re asking “What is a VPN?” Don’t worry, this ultimate VPN guide will cover everything you need to know about a VPN. We are" last_modified: "2026-10-30T12:10:30+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://secureblitz.com/feed/" wpe_sourcepermalink: "https://secureblitz.com/ultimate-vpn-guide-what-is-a-vpn/" --- # The Ultimate VPN Guide – What Is A VPN? Did you hear about a VPN and don’t know what it means and how it works, so you’re asking “What is a VPN?” Don’t worry, this ultimate VPN guide will cover everything you need to know about a VPN. We are in an era where being careless with your online privacy can cost you more. You […] The post [The Ultimate VPN Guide – What Is A VPN?](https://secureblitz.com/ultimate-vpn-guide-what-is-a-vpn/) appeared first on [SecureBlitz Cybersecurity](https://secureblitz.com/). --- --- title: "NCSC-2026-0461 [1.00] [M/H] Kwetsbaarheden verholpen in Linux kernel" url: "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0461" lang: "en-US" type: "post" description: "Linux heeft kwetsbaarheden verholpen in de IPv4 TCP stack en het IPv4 networking subsystem van de Linux kernel. De eerste kwetsbaarheid betreft een race condition in de IPv4 TCP stack die leidt tot een use-after-free van socketopties tijdens gelijktijdige TCP" last_modified: "2026-10-30T12:08:35+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://advisories.ncsc.nl/rss/advisories" wpe_sourcepermalink: "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0461" --- # NCSC-2026-0461 [1.00] [M/H] Kwetsbaarheden verholpen in Linux kernel Linux heeft kwetsbaarheden verholpen in de IPv4 TCP stack en het IPv4 networking subsystem van de Linux kernel. De eerste kwetsbaarheid betreft een race condition in de IPv4 TCP stack die leidt tot een use-after-free van socketopties tijdens gelijktijdige TCP SYN retransmissies of request socket migraties. Dit kan resulteren in systeeminstabiliteit of geheugenbeschadiging. De oorzaak is het voortijdig vrijgeven van inet_opt en ireq_opt structuren. De tweede kwetsbaarheid betreft een onjuiste validatie van checksum metadata in IPv4 pakketten, waardoor lokale aanvallers of onbetrouwbare gast-virtuele machines malformed checksum data kunnen gebruiken om willekeurige code op de host uit te voeren, systeemcrashes te veroorzaken of gevoelige informatie te lekken. Deze kwetsbaarheid, bekend als PwnEscape, maakt gast-naar-host ontsnapping mogelijk. Hoewel door de complexiteit van misbruik en binnen de bekende distro’s aanwezige aanvullende maatregelen, grootschalig misbruik niet waarschijnlijk is, zijn deze kwetsbaarheden in de linux-kernel toch opvallend, aangezien kwetsbaarheden in de netwerkstacks van de kernel een van de weinige soorten kwetsbaarheden zijn die op afstand en zonder voorafgaande authenticatie zijn te misbruiken, maar wel potentieel de kernel in gevaar brengen. --- --- title: "How to prioritize remediation after a pentest: a practitioner workflow" url: "https://securityaffairs.com/202110/hacking/how-to-prioritize-remediation-after-a-pentest-a-practitioner-workflow.html" lang: "en-US" type: "post" description: "A practical pentest workflow combines CVSS, EPSS and business impact to validate findings, prioritize fixes and document remediation decisions. Remediation prioritization after a pentest is the process of ranking and ordering security findings based on their risk, exploitability, and business" last_modified: "2026-10-30T12:06:39+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://securityaffairs.com/feed" wpe_sourcepermalink: "https://securityaffairs.com/202110/hacking/how-to-prioritize-remediation-after-a-pentest-a-practitioner-workflow.html" --- # How to prioritize remediation after a pentest: a practitioner workflow ## A practical pentest workflow combines CVSS, EPSS and business impact to validate findings, prioritize fixes and document remediation decisions. Remediation prioritization after a pentest is the process of ranking and ordering security findings based on their risk, exploitability, and business impact. A penetration test can produce any number of findings, ranging from the very low (zero) to the very high (hundreds). The security of the tested organization depends on the findings management processes addressing the most important results first. - CVSS alone misranks risk. Accurate prioritization relies on combining CVSS, EPSS, and business context. - 68.4% of practitioners say a 500+ candidate finding set would strain the team or be unmanageable, so it’s important to validate first. - 81.7% of practitioners see AI-generated findings that [need significant manual validation](https://securityaffairs.com/196991/ai/the-inconvenient-truth-about-ai-pentesting-someone-has-to-check-all-the-work.html), so validation with concrete proof remains essential. - Document every deprioritization, because that record counts as audit evidence. ## Why aren’t CVSS scores alone enough to inform remediation? When prioritizing pentest results, some practitioners rely solely on frameworks like the Common Vulnerability Scoring System (CVSS). The logic is sound: the higher a vulnerability’s CVSS score is, the more risk it poses, and the sooner you should fix it, right? Unfortunately, the reality is much more complicated. Boiling down a complex ecosystem of risk into a one-dimensional number means ignoring the wider business context. In the end, that means you fix vulnerabilities that pose serious _theoretical_ risk first, while genuine exposures get pushed to the back of the queue. Lets use two hypothetical vulnerabilities as an example. - Vulnerability A is an RCE flaw, CVSS 9.8, on an isolated intranet site. - Vulnerability B is a [BOLA flaw](https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/), CVSS 6.5, on a public facing production payment API. Now think about which one you would fix first. Would you prioritize the“critical” flaw on an intranet site, containing no sensitive data that attackers could only reach if they’d already compromised your internal network? Or would you prioritize the “medium” flaw on an API that processes live credit card transactions, and that any script kiddie could manipulate? Across an entire organization, or multiple organizations if you’re a consultant or MSP, those critical flaws can really pile up. In one [AI pentesting survey](https://pentest-tools.com/insights/ai-pentesting-survey) of 158 base practitioners by Pentest-Tools.com, conducted in June 2026, 68.4% of respondents said a 500+ candidate finding set would strain the team or be unmanageable. Approaching risk prioritization by trying to fix every “Critical” finding is going to exhaust you and your team. That’s when people make mistakes, and you end up with a major incident on your hands. ## What separates a validated finding from a candidate? That same distinction, in part, separates a candidate finding from a validated one. For example, vulnerability with a high CVSS score but near-zero exploitability should remain a candidate. To graduate a vulnerability from a candidate to a legally and technically validated finding, it must pass through a strict filter that involves three processes. The first step is to eliminate as much administrative noise as possible. That means deduplicating findings and removing any that are obviously non-exploitable.  Then, you need to _confirm_ exploitability. That typically means executing a safe, controlled attack path against the target environment to prove that a state change, data exposure, or privilege escalation can actually occur. Finally, you need concrete evidence. A validated finding cannot rely on a generic tool’s “confidence score.” It must include comprehensive proof that a developer or auditor can immediately follow: - Technical proof tends to include HTTP request/response traces or specific error payloads. - Proof of impact includes things like screenshots or server-side telemetry demonstrating unauthorized data access. Now, many vendors are going to claim that AI-generated findings ease the strain of exploit validation. In many cases, they’re telling the truth. But as with any AI technology, a healthy level of skepticism is important. According to the same study, 81.7% of respondents encounter AI-generated findings that need significant manual exploit validation at least sometimes. ## How do CVSS, EPSS and business context combine into a ranking? Together, CVSS, Exploit Prediction Scoring System (EPSS) scores, and business context create a single risk ranking that reflects real-world danger to the tested organization. **CVSS**, as mentioned earlier, measures theoretical severity. It tells you how bad a flaw is in a vacuum, but is entirely blind to context. **EPSS** measures probability. It tells you how likely an attacker is to exploit a flaw in the wild over the next 30 days, but doesn’t measure the potential impact of an exploitation. **Business context** measures operational impact. It tells you the value of the affected asset, how easily an attacker can reach a flaw, and what they can steal. It tells you nothing, however, about the threat itself. Ultimately, business context is expressed as residual risk, the danger left over after you factor in your existing defenses. Calculating it relies on measuring four factors: - **Exposure:** Whether a server is open to the public internet. - **User count:** How many people use a system. - **Data sensitivity:** Whether the system holds sensitive information. - **Compensating controls:** Whether you have firewalls or antivirus tools actively blocking the attack path. By checking these boxes, you won’t waste time fixing a “Critical” bug locked in an empty, disconnected server. Instead, you’ll prioritize the “Medium” bug on your public checkout page that hackers are actively trying to breach. ## What goes first when dev time is limited? Sometimes, you’re not going to have much time for remediation. That’s natural. In those situations, **prioritize validated findings with high threat activity (EPSS score) and critical business exposure.** They’re the findings that pose the most threat to your organization. Prioritization done well is itself evidence. A ranked, validated list, with a written reason for what was deprioritized, is what a team can defend later. You’ll need to record the owner (the specific individual accepting the risk), the date of the decision, the technical operational basis for deprioritization (such as an active compensating control), and a hard review date for re-evaluation. ## Why does the ranked list count as audit evidence? A prioritized ranking list counts as valid audit evidence because it proves compliance alignment with several major security frameworks. For example: - [ISO 27001 A.8.8](https://www.iso.org/standard/27001) demands that organizations evaluate real-world exposure, take targeted corrective actions, and retain objective evidence that the remediation loop has successfully closed. - [PCI DSS 11.4](https://www.pcisecuritystandards.org/document_library/) mandates that penetration testing actively validates and exploits findings, with formal retesting conducted after significant organizational changes. - [SOC 2 CC7.1](https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022) relies on this documentation to confirm that an organization maintains systemic operational consistency and rigorous vulnerability triage over time. A ranked, validated list also gives MSPs and MSSPs a clear, auditable record of truth that clients can either accept or challenge with their own evidence. This transparency ensures both sides agree on which real-world risks need to be addressed first. ## What does a defensible ranking record contain? A defensible ranking record contains the validated asset identification, its technical CVSS severity, its real-world EPSS probability, the active compensating controls defining its residual list, the formal sign-off from the risk owner, and the targeted review schedule. **About the Author:** J_osh Breaker-Rolfe is a Content writer at_ [_Bora_](https://welcometobora.com/)_. He graduated with a degree in Journalism in 2021 and has a background in cybersecurity PR. He’s written on a wide range of topics, from AI to Zero Trust, and is particularly interested in the impacts of cybersecurity on the wider economy._ **Follow me on Twitter: **[**@securityaffairs**](https://twitter.com/securityaffairs)** and **[**Facebook**](https://www.facebook.com/sec.affairs)** and **[**Mastodon**](https://infosec.exchange/@securityaffairs)**** [**Pierluigi Paganini**](http://www.linkedin.com/pub/pierluigi-paganini/b/742/559)**** **(**[**SecurityAffairs**](http://securityaffairs.co/wordpress/)** – hacking, pentest)** --- --- title: "Chinese Actor Compromises US Government Network Via Chained PHP2Shell Exploit" url: "https://www.infosecurity-magazine.com/news/chinese-us-government-chained-php2/" lang: "en-US" type: "post" description: "Dream found that a suspected Chinese-nexus actor gained root access to Palo Alto Network firewall servers to target government organizations" last_modified: "2026-10-30T12:00:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.infosecurity-magazine.com/rss/news/" wpe_sourcepermalink: "https://www.infosecurity-magazine.com/news/chinese-us-government-chained-php2/" --- # Chinese Actor Compromises US Government Network Via Chained PHP2Shell Exploit Dream found that a suspected Chinese-nexus actor gained root access to Palo Alto Network firewall servers to target government organizations --- --- title: "Why Urgent Security Fixes Aren’t Fixed. Observe, Prove, Act, Confirm Gets Them Moving" url: "https://thehackernews.com/2026/10/why-urgent-security-fixes-arent-fixed.html" lang: "en-US" type: "post" description: "The alert is critical. The fix is known. And the ticket sits in a queue for days. Security teams understand the risk, but the people who keep applications available need proof that the change won’t break anything.  Their concerns are" last_modified: "2026-10-30T11:58:53+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://feeds.feedburner.com/TheHackersNews?format=xml" wpe_sourcepermalink: "https://thehackernews.com/2026/10/why-urgent-security-fixes-arent-fixed.html" --- # Why Urgent Security Fixes Aren’t Fixed. Observe, Prove, Act, Confirm Gets Them Moving The alert is critical. The fix is known. And the ticket sits in a queue for days. Security teams understand the risk, but the people who keep applications available need proof that the change won’t break anything.  Their concerns are practical. An IPS protection could block legitimate traffic. A configuration change could interrupt a service. An endpoint policy could affect an application --- --- title: "Top 8 Considerations To Choose The Right VPN Service" url: "https://secureblitz.com/choose-the-right-vpn-service/" lang: "en-US" type: "post" description: "This post outlines the top 8 key considerations for selecting the ideal VPN service. With the surge in remote work in 2020, the interest in VPN services has never been higher. Most VPN service providers noted the massive spike in" last_modified: "2026-10-30T11:55:24+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://secureblitz.com/feed/" wpe_sourcepermalink: "https://secureblitz.com/choose-the-right-vpn-service/" --- # Top 8 Considerations To Choose The Right VPN Service This post outlines the top 8 key considerations for selecting the ideal VPN service. With the surge in remote work in 2020, the interest in VPN services has never been higher. Most VPN service providers noted the massive spike in interest in using VPN services in 2020. Surfshark VPN (a reputable service provider) attributes this almost […] The post [Top 8 Considerations To Choose The Right VPN Service](https://secureblitz.com/choose-the-right-vpn-service/) appeared first on [SecureBlitz Cybersecurity](https://secureblitz.com/). --- --- title: "Binance Probes DevOps Engineer’s Hacked Laptop After $6.3B Theft" url: "https://hackread.com/binance-devops-engineer-hacked-laptop-billion-theft/" lang: "en-US" type: "post" description: "Binance probes a DevOps engineer’s hacked laptop after a $6.3 billion theft linked by researchers to North Korean hackers, and promises to cover all customer losses." last_modified: "2026-10-30T11:54:34+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://hackread.com/feed/" wpe_sourcepermalink: "https://hackread.com/binance-devops-engineer-hacked-laptop-billion-theft/" --- # Binance Probes DevOps Engineer’s Hacked Laptop After $6.3B Theft Binance probes a DevOps engineer’s hacked laptop after a $6.3 billion theft linked by researchers to North Korean hackers, and promises to cover all customer losses. --- --- title: "Microsoft Releases Emergency Fix for Windows 11 Remote Desktop Connection Failures" url: "https://gbhackers.com/windows-11-remote-desktop-connection-failures/" lang: "en-US" type: "post" description: "Microsoft has resolved an issue in Windows 11 that prevented non-administrator users from connecting to devices with Administrator protection enabled. This fix was included in KB5127936, released on October 28, 2026, and is part of subsequent updates. While this issue" last_modified: "2026-10-30T11:54:04+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://gbhackers.com/feed/" wpe_sourcepermalink: "https://gbhackers.com/windows-11-remote-desktop-connection-failures/" --- # Microsoft Releases Emergency Fix for Windows 11 Remote Desktop Connection Failures Microsoft has resolved an issue in Windows 11 that prevented non-administrator users from connecting to devices with Administrator protection enabled. This fix was included in KB5127936, released on October 28, 2026, and is part of subsequent updates. While this issue is urgent for affected organizations, Microsoft has categorized the release as a preview update rather […] The post [Microsoft Releases Emergency Fix for Windows 11 Remote Desktop Connection Failures](https://gbhackers.com/windows-11-remote-desktop-connection-failures/) appeared first on [GBHackers Security | #1 Globally Trusted Cyber Security News Platform](https://gbhackers.com/). --- --- title: "Hackers Exploit Ivanti Connect Secure Zero-Day Vulnerabilities to Gain Root Access and Steal Credentials" url: "https://gbhackers.com/hackers-exploit-ivanti-connect-secure-zero-day-vulnerabilities/" lang: "en-US" type: "post" description: "Hackers exploited a chain of zero-day vulnerabilities in Ivanti Connect Secure (ICS) VPN appliances, allowing them to execute commands with root access, steal credentials, and probe internal networks. Volexity has identified the unknown attacker as UTA0576 and traced the exploitation" last_modified: "2026-10-30T11:46:41+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://gbhackers.com/feed/" wpe_sourcepermalink: "https://gbhackers.com/hackers-exploit-ivanti-connect-secure-zero-day-vulnerabilities/" --- # Hackers Exploit Ivanti Connect Secure Zero-Day Vulnerabilities to Gain Root Access and Steal Credentials Hackers exploited a chain of zero-day vulnerabilities in Ivanti Connect Secure (ICS) VPN appliances, allowing them to execute commands with root access, steal credentials, and probe internal networks. Volexity has identified the unknown attacker as UTA0576 and traced the exploitation back to October 3, 2026, targeting an appliance that was fully patched at the time. […] The post [Hackers Exploit Ivanti Connect Secure Zero-Day Vulnerabilities to Gain Root Access and Steal Credentials](https://gbhackers.com/hackers-exploit-ivanti-connect-secure-zero-day-vulnerabilities/) appeared first on [GBHackers Security | #1 Globally Trusted Cyber Security News Platform](https://gbhackers.com/). --- --- title: "Fake Polymarket Scam Network Claims Nearly $11 Million in Cryptocurrency Deposits" url: "https://gbhackers.com/fake-polymarket-scam/" lang: "en-US" type: "post" description: "Russian-language “traffer” teams are selling ready-made fake prediction-market platforms to affiliates. One of them, AtlasCore, claims about $10.97 million in victim deposits. Recorded Future’s Insikt Group tracked the campaigns, which impersonate sites like Polymarket and Kalshi. The deposit figures come" last_modified: "2026-10-30T11:46:35+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://gbhackers.com/feed/" wpe_sourcepermalink: "https://gbhackers.com/fake-polymarket-scam/" --- # Fake Polymarket Scam Network Claims Nearly $11 Million in Cryptocurrency Deposits Russian-language “traffer” teams are selling ready-made fake prediction-market platforms to affiliates. One of them, AtlasCore, claims about $10.97 million in victim deposits. Recorded Future’s Insikt Group tracked the campaigns, which impersonate sites like Polymarket and Kalshi. The deposit figures come from the threat actors themselves and are unverified. Fake Polymarket scam Since spring 2026, AtlasCore, […] The post [Fake Polymarket Scam Network Claims Nearly $11 Million in Cryptocurrency Deposits](https://gbhackers.com/fake-polymarket-scam/) appeared first on [GBHackers Security | #1 Globally Trusted Cyber Security News Platform](https://gbhackers.com/). --- --- title: "Hackers steal and publish data on 41,000 Homeland Security workers" url: "https://www.malwarebytes.com/blog/data-breaches/2026/10/hackers-steal-and-publish-data-on-41000-homeland-security-workers" lang: "en-US" type: "post" description: ".kadence-column482644_f2c16d-bc > .kt-inside-inner-col{padding-top:20px;padding-right:20px;padding-bottom:10px;padding-left:20px;}.kadence-column482644_f2c16d-bc > .kt-inside-inner-col{column-gap:var(--global-kb-gap-sm, 1rem);}.kadence-column482644_f2c16d-bc > .kt-inside-inner-col{flex-direction:column;}.kadence-column482644_f2c16d-bc > .kt-inside-inner-col > .aligncenter{width:100%;}.kadence-column482644_f2c16d-bc > .kt-inside-inner-col{background-color:rgba(255, 229, 229, 0.38);}.kadence-column482644_f2c16d-bc > .kt-inside-inner-col:before{opacity:0.3;}.kadence-column482644_f2c16d-bc{position:relative;}@media all and (max-width: 1024px){.kadence-column482644_f2c16d-bc > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}@media all and (max-width: 767px){.kadence-column482644_f2c16d-bc > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}In this articleHackers published work details and internal group memberships" last_modified: "2026-10-30T11:33:12+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.malwarebytes.com/blog/feed/index.xml" wpe_sourcepermalink: "https://www.malwarebytes.com/blog/data-breaches/2026/10/hackers-steal-and-publish-data-on-41000-homeland-security-workers" --- # Hackers steal and publish data on 41,000 Homeland Security workers .kadence-column482644_f2c16d-bc > .kt-inside-inner-col{padding-top:20px;padding-right:20px;padding-bottom:10px;padding-left:20px;}.kadence-column482644_f2c16d-bc > .kt-inside-inner-col{column-gap:var(–global-kb-gap-sm, 1rem);}.kadence-column482644_f2c16d-bc > .kt-inside-inner-col{flex-direction:column;}.kadence-column482644_f2c16d-bc > .kt-inside-inner-col > .aligncenter{width:100%;}.kadence-column482644_f2c16d-bc > .kt-inside-inner-col{background-color:rgba(255, 229, 229, 0.38);}.kadence-column482644_f2c16d-bc > .kt-inside-inner-col:before{opacity:0.3;}.kadence-column482644_f2c16d-bc{position:relative;}@media all and (max-width: 1024px){.kadence-column482644_f2c16d-bc > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}@media all and (max-width: 767px){.kadence-column482644_f2c16d-bc > .kt-inside-inner-col{flex-direction:column;justify-content:center;}} ## **In this article** - [Hackers](https://www.malwarebytes.com/cybersecurity/basics/hacker) published work details and internal group memberships for more than 41,000 DHS workers. - The data could enable targeted scams, harassment, stalking, or physical threats. - DHS employees should follow agency guidance, verify unexpected contact, and report threats to security. A group of hackers calling themselves the Department of Peace says it stole and published the personal details of more than 41,000 people working for the US Department of Homeland Security (DHS). The department says it is aware of a potential breach. The group, which also claimed the theft of contract documents from the DHS in March, gave the data to Swiss hacktivist maia arson crimew, who published it in collaboration with the transparency collective DDoSecrets. The latter also published the [BlueLeaks](https://theintercept.com/collections/blueleaks/) data dump that listed law enforcement officers’ details in 2020. The aim of publishing the data was to replace “anonymity with accountability,” DDoSecrets co-founder Emma Best said in an online statement. According to [TechCrunch](https://techcrunch.com/2026/10/28/hacker-stole-personnel-data-about-thousands-of-homeland-security-employees-including-cbp-and-ice-agents/), timestamps on the records suggest the data was taken around mid-August. The group said it had launched the attack in response to a July 17 statement by DHS Secretary Markwayne Mullin, in which he [promised](https://youtu.be/FoF5dTI-xQw?si=uMV7MMbrpZKmvn_v&t=26) to “turn up the heat” with traffic stops. ## What was stolen? The data files published online, which the publishers have called “Icepick,” span staff at nearly 7,000 offices. They include the names, work email addresses, phone numbers, office addresses, job titles and membership in internal DHS groups. The employees impacted include almost 6,600 Immigration and Customs Enforcement (ICE) employees. ICE is the DHS unit responsible for immigration enforcement and deportations in the US. The dataset also carried details of over 21,000 Customs and Border Protection (CBP) employees, along with information on people who work at the Cybersecurity and Infrastructure Security Agency (CISA). The data dump revealed less information than the [ShinyHunters’ FBI data heist](https://www.malwarebytes.com/blog/data-breaches/2026/09/fbi-agents-blood-tests-and-doctors-notes-surface-after-breach) in September, which reportedly contained Social Security numbers, emergency contacts, medical records and home addresses. Nevertheless, this is more than just a phone book of folks in the DHS. For one thing, it doesn’t take much to cross-reference data. [Reuters](https://www.reuters.com/legal/government/leak-website-releases-data-tens-thousands-dhs-employees-2026-10-28/) matched six DHS employees’ data to credit bureau records and breach data from a dark web intelligence platform. Online activists regularly use open-source intelligence (OSINT) to “doxx” people from very few clues, meaning that even a leak of basic identity information can put someone in danger. In fact, the creators of a separate searchable version say they added information through automated and manual research. So some details shown in that version may not have come from the data stolen from DHS. ![](https://www.malwarebytes.com/wp-content/uploads/sites/2/2024/11/phishing-scam-protection-icon-0B73D5.svg?w=1024) ### **Breaches happen every day.** Don’t be the last to know. [SEE PLANS](https://www.malwarebytes.com/identity-theft-protection) The data in this case also included membership of groups within Active Directory, a Microsoft tool that contains identity information about computer users. Active Directory controls who can access different internal tools, services, and third-party software within an organization. The files listed over 200 CBP users in a group that could access the facial recognition tool Mobile Fortify. Other groups reference a service called Penlink, which the company claims can track the location data of hundreds of millions of mobile devices. According to [the Guardian](https://www.theguardian.com/us-news/2026/oct/28/homeland-security-data-leak), job titles in the data dump show which agents were assigned to sensitive jobs such as special operations, surveillance, and undercover work. ## How did they get the data? The Department of Peace said that it got to the information via a single sign-on (SSO) service provided by identity company Okta. SSO is a prized target for hackers because a single [authentication](https://www.malwarebytes.com/cybersecurity/basics/what-is-authentication) can get a user into many different workplace services and applications. Okta says it has no evidence its data or systems were compromised, but that doesn’t rule out someone abusing a DHS account with stolen credentials. DHS told reporters it was aware of a potential breach. One DHS employee whose data showed up in the breach told Reuters they hadn’t heard anything about it. ## What DHS employees can do now The leaked records include work contact details and internal group memberships. This information could help attackers create convincing messages or calls, and may expose some employees to unwanted attention or threats. DHS has warned about the risk of harassment, stalking, and physical harm. It is not yet clear whether the leak has led to specific threats or affected any operations. If you work for DHS: - Follow security advice and instructions from the DHS. - Treat unexpected calls, emails, and texts about your role or colleagues with caution. Verify them through a contact method you already trust, and never share passwords or MFA codes. - Change any personal passwords you’ve reused for work, and turn on MFA where available. Follow your agency’s process for work accounts. - Report suspicious contact or threats to your agency’s security team. If you believe there’s an immediate danger, contact law enforcement. Do you think your information might have been leaked in a data breach? Check out the Malwarebytes [Identity Theft Protection](https://www.malwarebytes.com/identity-theft-protection) service. ![](https://www.malwarebytes.com/wp-content/uploads/sites/2/2023/08/Privacy.svg?w=1024) ### **Someone’s got their eye on your personal information. **Make sure it’s us. [PROTECT YOUR IDENTITY](https://www.malwarebytes.com/identity-theft-protection) --- --- title: "Pre-SIEM Detection for MSSPs" url: "https://socprime.com/blog/pre-siem-detection-for-mssps/" lang: "en-US" type: "post" description: "tl;dr Prime Detect runs detection rules on your clients’ event streams before data reaches the SIEM. It applies Sigma rules to events in transit, tags each match with a severity and a MITRE ATT&CK technique, and links related matches into" last_modified: "2026-10-30T11:26:50+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://socprime.com/feed/" wpe_sourcepermalink: "https://socprime.com/blog/pre-siem-detection-for-mssps/" --- # Pre-SIEM Detection for MSSPs ![](https://socprime.com/wp-content/uploads/Pre-SIEM-Detection-for-MSSPs-400x234.jpg) **tl;dr** Prime Detect runs detection rules on your clients’ event streams before data reaches the SIEM. It applies Sigma rules to events in transit, tags each match with a severity and a MITRE ATT&CK technique, and links related matches into attack chains. In client testing, about 7% of telemetry was tagged. MSSPs use Prime Detect to give every client the same 20,000+ detections regardless of which SIEM that client runs, to send less data into SIEMs they pay to operate, and to keep each client’s data inside its own pipeline. It works alongside the SIEMs you already run. It does not replace them. [Contact Sales](https://socprime.com/blog/pre-siem-detection-for-mssps/#sp-cta-form-modal) ## Why MSSPs are moving detection ahead of the SIEM An MSSP’s detection coverage is usually set by whatever each client’s SIEM can hold. That creates three problems that grow with every client you add. - **Uneven coverage.** Clients run different SIEMs with different rule limits. The same threat can be caught for one client and missed for another, depending on the platform underneath. - **Ingest cost.** Where you operate the SIEM, every event ingested is a cost against your margin, whether it carries a threat signal or not. - **Engineering load.** Your detection engineers spend their time porting and tuning the same rules across platforms instead of building the detections clients actually pay for. Prime Detect moves detection upstream. Rules run on events as they stream through the pipeline, before any SIEM ingests them. Coverage depends on the compute you assign, not on each client’s SIEM. You then decide, per client, what reaches the SIEM. ## What Prime Detect does ### Detection in the stream - Applies Sigma rules to events in transit, before SIEM ingest - Runs 20,000+ detection rules plus your own custom detections, with no fixed rule ceiling - Tags every match with a severity and a MITRE ATT&CK technique - Links related matches into attack chains, so analysts see a sequence of activity instead of isolated alerts ### Tagged telemetry you can route - Tags about 7% of telemetry, based on client testing - Sends tagged events to the SIEM and the rest to warm or cold storage, by your rules - Produces structured, ATT&CK-labeled events that AI triage and SOAR tools can use directly ### Deployment and control - Runs on Kafka and Kubernetes you or your clients operate - Keeps data inside the pipeline, with no outbound connection required - Deploys air-gapped or in the cloud - Available open source or under an Enterprise license ## How it fits with the SIEMs you already run Prime Detect sits between the event pipeline and the SIEM. Nothing in the SIEM has to change, so it works across a mixed client base. ![](https://socprime.com/wp-content/uploads/image-158-920x518.png) MSSPs typically deploy it in one of two ways: - **Shared, multi-tenant:** one Prime Detect deployment in your environment, with detections and routing set per tenant. - **Per client:** a deployment inside the client’s own infrastructure, for clients with strict data residency or air-gap requirements. Rollout follows the same three steps either way: - Forward everything to the SIEM as today, with Detect tags added to matched events. - Add a SIEM index or dashboard that raises Detect-tagged events as high-priority alerts. - Once tuned, route untagged events to warm or cold storage to cut ingest. ### What Prime Detect does not do - It does not replace the SIEM for centralized logging, search, investigation, or retention. - It does not decide whether an incident is significant or reportable. Your incident process makes that call. - It does not make data transfer decisions for you. Where data goes, and under which agreement, stays with your firm and your clients. ## NIS2, DORA, HIPAA, and GDPR: where Prime Detect fits MSSPs carry their own obligations and inherit their clients’. NIS2 defines managed security service providers in Article 6(40) and lists them in Annex I, so many MSSPs are covered entities in their own right. Prime Detect supports the detection side of each rule below. It does not discharge any of them alone. | Rule | What it requires | Where Prime Detect fits | | --- | --- | --- | | NIS2 Art. 23 | Early warning within 24 hours and incident notification within 72 hours of becoming aware of a significant incident | Surfaces chained activity earlier, so your team becomes aware sooner and has ATT&CK-mapped evidence for the notice | | DORA Art. 28 | Financial entities stay fully responsible for DORA compliance when they use ICT service providers | Gives your financial clients a per-tenant record of what was detected, which they need to show oversight of you | | HIPAA 45 CFR 164.312(b) | Mechanisms that record and examine activity in systems containing ePHI | Examines every event in the stream and records matches with severity and technique. Logging and retention stay in the SIEM | | HIPAA 45 CFR 164.308(b), 164.314(a) | Business associates report security incidents they become aware of to the covered entity | Tagged matches and attack chains give you the detail to report quickly and specifically | | GDPR Ch. V (Arts. 44–49) | Transfers of personal data outside the EU/EEA only under Chapter V conditions, including onward transfers | Runs inside your or your client’s pipeline with no outbound connection, so detection itself adds no transfer | ## Sell coverage, not ingest Most MSSPs price and staff around SIEM volume. That ties margin to how much data clients send, and ties coverage to which platform each client happens to run. Prime Detect separates the two. Every client gets the same detection baseline. You send the SIEM only the events that matter. Each tenant gets an ATT&CK-mapped record of what you detected, which is the evidence regulated clients need to show oversight of their provider. Your engineers spend their time on the detections that set your service apart. **See it run.** Watch Prime Detect work against a live event stream before you commit to a pilot. Request a demo, explore the live demo, or download the open source version to run it yourself. ## FAQ How can an MSSP keep detection capacity in step with client growth? Take rule capacity out of each client’s SIEM. Prime Detect runs detections on the event stream, so coverage scales with the compute you assign, not with SIEM limits. Each new client gets the same 20,000+ detections, whether they run one SIEM or another. What is the difference between pre-SIEM detection and direct SIEM ingestion? With direct ingestion, logs go into the SIEM and detection rules run there. Pre-SIEM detection runs the rules on events in transit, before the SIEM ingests them. Prime Detect is a pre-SIEM detection layer. It tags matches and lets you send only high-priority events to the SIEM. Can one Prime Detect deployment serve multiple clients? Yes. MSSPs can run a shared multi-tenant deployment with detections and routing set per tenant. They can also deploy inside a client’s own infrastructure when data residency or an air gap requires it. How is Prime Detect licensed for MSSPs? Prime Detect is available open source or under an Enterprise license. Enterprise licensing for MSSPs is typically based on the number of clients served. Contact SOC Prime for pricing for your architecture. What do NIS2 and DORA require of MSSPs? NIS2 defines MSSPs and brings many of them into scope as covered entities. Under Article 23, they must give an early warning within 24 hours of becoming aware of a significant incident and a notification within 72 hours. Under DORA Article 28, financial clients remain fully responsible for their own compliance when they use an MSSP, so they will expect evidence of what you detect. What does HIPAA require for audit trails and incident reporting? The HIPAA Security Rule, 45 CFR 164.312(b), requires mechanisms that record and examine activity in systems containing electronic protected health information. Under 164.308(b) and 164.314(a), a business associate must report security incidents it becomes aware of to the covered entity, including breaches of unsecured protected health information. Does pre-SIEM detection create GDPR data transfer issues? Not by itself. Prime Detect runs inside your or your client’s pipeline and needs no outbound connection, so detection adds no transfer of personal data. Where the rest of the data goes, and under which Chapter V mechanism, remains your firm’s decision. Will Prime Detect commoditize our detection engineering service? It shifts where your engineers spend their time. Baseline coverage comes from the 20,000+ rule library, which SOC Prime keeps adding to. Your team can focus on client-specific detections, threat hunting, and tuning, which is the work clients see as your differentiator. The post [Pre-SIEM Detection for MSSPs](https://socprime.com/blog/pre-siem-detection-for-mssps/) appeared first on [SOC Prime](https://socprime.com/). --- --- title: "Binance Hit by Record-Breaking $6.3bn Hack in Largest Cryptocurrency Heist in History" url: "https://www.infosecurity-magazine.com/news/binance-record-hack-crypto-heist/" lang: "en-US" type: "post" description: "Leading cryptocurrency analysts have attributed the cyber-attack to a North Korean elite hacking unit" last_modified: "2026-10-30T11:25:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.infosecurity-magazine.com/rss/news/" wpe_sourcepermalink: "https://www.infosecurity-magazine.com/news/binance-record-hack-crypto-heist/" --- # Binance Hit by Record-Breaking $6.3bn Hack in Largest Cryptocurrency Heist in History Leading cryptocurrency analysts have attributed the cyber-attack to a North Korean elite hacking unit --- --- title: "The Morning Risk Report: Binance and Polymarket Suspend Trading After Hacks" url: "https://www.wsj.com/risk-compliance-journal/the-morning-risk-report-binance-and-polymarket-suspend-trading-after-hacks-9261a44c?mod=rss_Technology" lang: "en-US" type: "post" description: "Plus: Trump administration promised tariff relief in talks to secure U.S. Audi factory and Cleveland-Cliffs to retain Stelco amid jobs dispute with Canadian government." last_modified: "2026-10-30T11:23:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://feeds.content.dowjones.io/public/rss/RSSWSJD" wpe_sourcepermalink: "https://www.wsj.com/risk-compliance-journal/the-morning-risk-report-binance-and-polymarket-suspend-trading-after-hacks-9261a44c?mod=rss_Technology" --- # The Morning Risk Report: Binance and Polymarket Suspend Trading After Hacks Plus: Trump administration promised tariff relief in talks to secure U.S. Audi factory and Cleveland-Cliffs to retain Stelco amid jobs dispute with Canadian government. --- --- title: "Microsoft finally fixes VPN issues caused by September updates" url: "https://www.bleepingcomputer.com/news/microsoft/microsoft-finally-fixes-vpn-issues-caused-by-september-updates/" lang: "en-US" type: "post" description: "Microsoft has resolved Always On VPN connection failures triggered after installing the September 2026 Windows 11 security updates." last_modified: "2026-10-30T11:20:26+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.bleepingcomputer.com/feed/" wpe_sourcepermalink: "https://www.bleepingcomputer.com/news/microsoft/microsoft-finally-fixes-vpn-issues-caused-by-september-updates/" --- # Microsoft finally fixes VPN issues caused by September updates Microsoft has resolved Always On VPN connection failures triggered after installing the September 2026 Windows 11 security updates. […] --- --- title: "Claude Code extension poisoned with persistent SSH backdoor" url: "https://www.helpnetsecurity.com/2026/10/30/claude-code-extension-ssh-backdoor/" lang: "en-US" type: "post" description: "A tampered build of Anthropic’s Claude Code extension for VS Code-compatible editors planted an SSH backdoor on developers’ machines, researchers at macOS security firm Phorion have found. The malicious package, version 2.1.313, was published on Open VSX, an open-source marketplace" last_modified: "2026-10-30T11:15:26+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.helpnetsecurity.com/feed/" wpe_sourcepermalink: "https://www.helpnetsecurity.com/2026/10/30/claude-code-extension-ssh-backdoor/" --- # Claude Code extension poisoned with persistent SSH backdoor A tampered build of Anthropic’s Claude Code extension for VS Code-compatible editors planted an SSH backdoor on developers’ machines, researchers at macOS security firm Phorion have found. The malicious package, version 2.1.313, was published on Open VSX, an open-source marketplace for VS Code extensions run by the Eclipse Foundation. VS Code’s default extension store is Microsoft’s Visual Studio Marketplace, which never carried the compromised extension. Its terms of use limit it to Microsoft’s own products, … [More →](https://www.helpnetsecurity.com/2026/10/30/claude-code-extension-ssh-backdoor/) The post [Claude Code extension poisoned with persistent SSH backdoor](https://www.helpnetsecurity.com/2026/10/30/claude-code-extension-ssh-backdoor/) appeared first on [Help Net Security](https://www.helpnetsecurity.com/). --- --- title: "Pre-SIEM Detection for Financial Services" url: "https://socprime.com/blog/pre-siem-detection-for-financial-services/" lang: "en-US" type: "post" description: "tl;dr Prime Detect runs detection rules on your event stream before data reaches the SIEM. It applies Sigma rules to events in transit, tags each match with a severity and a MITRE ATT&CK technique, and links related matches into attack" last_modified: "2026-10-30T11:05:43+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://socprime.com/feed/" wpe_sourcepermalink: "https://socprime.com/blog/pre-siem-detection-for-financial-services/" --- # Pre-SIEM Detection for Financial Services ![](https://socprime.com/wp-content/uploads/Pre-SIEM-Detection-for-Financial-Services-400x234.jpg) **tl;dr** Prime Detect runs detection rules on your event stream before data reaches the SIEM. It applies Sigma rules to events in transit, tags each match with a severity and a MITRE ATT&CK technique, and links related matches into attack chains. In client testing, about 7% of telemetry was tagged. That is the slice worth sending to your SIEM. Large organizations use Prime Detect to run 20,000+ detections without SIEM rule limits, cut what they pay to ingest, and keep a mapped record of what they detect for regulations such as DORA and NYDFS. It works alongside your existing SIEM. It does not replace it. [Contact Sales](https://socprime.com/blog/pre-siem-detection-for-financial-services/#sp-cta-form-modal) ## Why banks are moving detection ahead of the SIEM A SIEM runs detection rules against data it has already ingested and indexed. For a large bank, that model hits two limits. **Rule capacity.** Most SIEM deployments run a few hundred active rules before search performance and cost become a problem. A team running 500 of them is choosing what not to see. **Ingest cost.** Every event the SIEM ingests is an event you pay to store and search, whether or not it carries a threat signal. Prime Detect moves detection upstream. Rules run against events as they stream through your Kafka pipeline, before ingest. Rule count is tied to the compute you give it, not to SIEM capacity. You then decide what reaches the SIEM based on what the rules found. Regulators set the floor. DORA Article 10 requires mechanisms to promptly detect anomalous activity. NYDFS Part 500 requires larger covered entities to centralize logging and security alerting. Neither sets a rule count, but both expect you to show that your detection program works. More detections, each mapped to ATT&CK, give you broader coverage and a clearer record of it. ## What Prime Detect does ### Detection in the stream - Applies Sigma rules to events in transit, before SIEM ingest - Runs 20,000+ detection rules plus your own custom detections, with no fixed rule ceiling - Tags every match with a severity and a MITRE ATT&CK technique - Links related matches into attack chains, so analysts see a sequence of activity instead of isolated alerts ### Tagged telemetry you can route - Tags about 7% of telemetry, based on client testing - Sends tagged events to the SIEM and the rest to warm or cold storage, by your rules - Produces structured, ATT&CK-labeled events that AI triage and SOAR tools can use directly ### Deployment and control - Runs on the Kafka and Kubernetes your team already operates - Keeps data inside your pipeline, with no outbound connection required - Deploys air-gapped or in the cloud - Available open source as DetectFlow, or under an Enterprise license ## How it fits with your existing SIEM Prime Detect sits between your event pipeline and your SIEM. Nothing in the SIEM has to change. Most teams roll it out in three steps: - Forward everything to the SIEM as today, with Detect tags added to matched events. - Add a SIEM index or dashboard that raises Detect-tagged events as high-priority alerts. - Once tuned, route untagged events to warm or cold storage to cut ingest. You can change the routing at any point as you learn what works in your environment. ### What Prime Detect does not do - It does not replace your SIEM for centralized logging, search, investigation, or retention. - It does not satisfy the NYDFS centralized logging requirement on its own. - It does not decide whether an incident is material or reportable. Your team makes that call. ## DORA, NYDFS, and SEC: where Prime Detect fits These rules set detection, incident, testing, and disclosure duties for the banks they cover. Prime Detect supports the detection side of each. It does not discharge any of them alone. | Rule | What it requires | Where Prime Detect fits | | --- | --- | --- | | DORA Art. 9 | Continuously monitor the security and functioning of ICT systems | Runs detections on every event in the stream, not a sampled subset | | DORA Art. 10 | Mechanisms to promptly detect anomalous activity | Detects in transit, ahead of SIEM ingest and indexing | | DORA Art. 17 | An incident process to detect, manage, classify, and notify | Each match carries severity and ATT&CK technique, giving a structured basis for classification | | DORA Art. 26 | Threat-led penetration testing (TLPT) at least every 3 years, if designated | ATT&CK mapping shows which tested techniques you had detections for | | NYDFS 500.14(b) | Class A companies: EDR plus centralized logging and security alerting | Adds detection coverage in front of your centralized logging. Does not replace it | | NYDFS 500.17(a) | Notify the superintendent within 72 hours of determining an incident occurred | Surfaces chained activity earlier, so investigation can start sooner | | SEC Form 8-K Item 1.05 | Registrants: determine materiality without unreasonable delay, file within 4 business days of that determination | Attack chains give the team scoping evidence faster. The materiality call stays with you | ## **The** detection** record examiners ask about** When an examiner asks how a bank detects threats, the answer is usually a list of SIEM rules. With Prime Detect, every detection is mapped to ATT&CK and tagged at the event level. You can show what you were watching for, what fired, and how related activity chained together. That is the record DORA’s incident process and NYDFS’s 72-hour notice depend on. When an incident happens, the work of building it should already be done. **See it run.** Watch Prime [Detect](https://primedetect.live/login) work against a live event stream before you commit to a pilot. Use the default user name and passwords listed. Request a demo, explore the live demo, or download DetectFlow to run it yourself. ## FAQ What is pre-SIEM detection? Pre-SIEM detection runs detection rules on events while they move through the data pipeline, before the SIEM ingests them. A SIEM-based model runs rules only on data the SIEM has already ingested. The difference is where the detection logic executes. Prime Detect is SOC Prime’s pre-SIEM detection layer How can a bank run more detection rules without adding SIEM capacity? Run the rules outside the SIEM. Prime Detect executes rules on the bank’s own Kafka and Kubernetes infrastructure, so rule count depends on that compute rather than SIEM limits. Banks can run 20,000+ rules instead of the few hundred a typical SIEM holds. How much data does Prime Detect send to the SIEM? That is your choice. In client testing, Prime Detect tagged about 7% of telemetry. Teams can send only tagged events to the SIEM and route the rest to lower-cost storage. Does pre-SIEM detection satisfy NYDFS 500.14(b)? No, not on its own. Section 500.14(b) requires Class A companies to centralize logging and security event alerting. Prime Detect adds detection in front of that system. It does not replace it. How is Prime Detect different from a pipeline tool like Cribl? Pipeline tools route, reduce, and transform data. Prime Detect runs detection logic on the data and tags what it finds. The two can run together: the pipeline shapes the stream, and Prime Detect identifies the threats in it. Can Prime Detect run in an air-gapped environment? Yes. Prime Detect runs inside your own pipeline and needs no outbound connection. It also supports cloud deployment. Is Prime Detect open source? Yes. The open source version is DetectFlow. SOC Prime also offers an Enterprise license. The post [Pre-SIEM Detection for Financial Services](https://socprime.com/blog/pre-siem-detection-for-financial-services/) appeared first on [SOC Prime](https://socprime.com/). --- --- title: "Don’t trust AI to keep your secrets" url: "https://www.computerworld.com/article/4242386/dont-trust-ai-to-keep-your-secrets.html" lang: "en-US" type: "post" description: "We talk to chatbots as if those conversations are private. But are they? Most people are confused. A survey commissioned by DuckDuckGo and published in August asked 1,944 American adults about chatbot privacy, and more than half (53%) did not" last_modified: "2026-10-30T11:00:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.computerworld.com/security/feed/" wpe_sourcepermalink: "https://www.computerworld.com/article/4242386/dont-trust-ai-to-keep-your-secrets.html" --- # Don’t trust AI to keep your secrets We talk to chatbots as if those conversations are private. But are they? Most people are confused. A [survey](https://spreadprivacy.com/ai-privacy-survey-aug26/) commissioned by DuckDuckGo and published in August asked 1,944 American adults about chatbot privacy, and more than half (53%) did not know whether their conversations were being used to train the bots. (They are.) Only a quarter of respondents knew that chatbot conversations can be subpoenaed. (They can.) Among self-described AI enthusiasts, 56% said they had confided to a chatbot something they had never told a close friend, parent, colleague, doctor, or therapist. That’s especially true on Character.AI, a chatbot service where users can chat and form “relationships” with customizable characters, including ones they create and share with the community. On Character.AI, some users chat about thoughts of suicide and self-harm, and they surrender private details like mental health disclosures, ages, private chats and voice calls, deep fears, and relationship struggles. Character.AI was all fun and games until earlier this month, when the company [filed for bankruptcy](https://www.computerworld.com/article/4236464/ai-bot-company-character-ai-seeks-bankruptcy-protection.html) and opened a court-supervised sale of its assets. Nobody knows who will end up with the company, or how much of the data on its millions of account holders will be sold as well. The most valuable asset for sale by the company may be its LLM, which has been substantially trained by users as they build and interact with characters. Legally, a company can sell personal data about its users if its privacy policy permits the transfer. [Character.AI’s privacy policy](https://character.ai/privacy) is spectacularly vague. It says the company may disclose “certain information” in the company’s sale. Nobody knows what that means. The US Trustee Office, an arm of the Justice Department, wants the judge to appoint a consumer privacy ombudsman to advise the court on user privacy. The judge could restrict the sale of company “records,” including user data. But here’s the part most people don’t understand: The Bankruptcy Code has no provision specifically addressing trained models. The legal status of LLMs and their training data has yet to be settled in law. That means it’s entirely possible that the data users fed into Character.AI will be sold to whoever buys it. Character.AI is just one handy example. The larger risk is all the other AI companies out there. ## More surprising facts about LLM privacy The core question is this: Can personal or proprietary information shared in a chat end up inside an LLM, where anyone might coax it out? The answer is a resounding “uh, maybe.” First of all, it depends on the AI chatbot service. The companies vary wildly in how they handle chat data, and the differences boil down to four questions: whether training on chats is on by default, whether human reviewers read them, how long they are kept, and whether they feed advertising. Major chatbot companies generally try to reassure users about privacy. They publish privacy controls, but their own policies admit that consumer chats may be used for training by default, read by human reviewers, or both, and the fine print shifts from company to company. Tellingly, some of them offer enterprise or business accounts that handle chat sessions privately. For example, they don’t use chat sessions in training data. That business accounts get extra privacy features sounds to me like an admission that individual accounts aren’t private. Some companies, such as OpenAI, let users opt out of having their chats tossed into the training data. But OpenAI’s help documentation says that turning off training does not delete the chats themselves. There are three main ways chatbot user data can be exposed. The first is bugs. In March 2023, a [bug](https://openai.com/index/march-20-chatgpt-outage/) lurking in an open-source library called “redis-py” let some ChatGPT users see other users’ chat titles and, possibly, the first message of new conversations. More than 1% of ChatGPT Plus subscribers active in a nine-hour window may have had their payment details exposed to other users: names, email addresses, payment addresses, card types, the last four digits of card numbers and expiration dates. The second is sharing. Some chatbots offer sharing features, and those features can publish chats to the world, whether on purpose or by accident. Once these sessions are posted, search engines are likely to gobble them up and make them searchable. In 2025, [Forbes reported](https://www.forbes.com/sites/iainmartin/2025/08/20/elon-musks-xai-published-hundreds-of-thousands-of-grok-chatbot-conversations/) that Google’s results showed more than 370,000 Grok conversations after users clicked “share,” and shared ChatGPT chats turned up in search results until OpenAI killed the option. The third is the absorption of chat sessions into the training data. Let’s take one simple example: an email address. People often paste in emails so that a chatbot will write the reply. These emails often contain names, email addresses and other information in the header, the signature, or both. The question I often ponder is this: If emails addressed to one person get pasted into chats hundreds of times, can a stranger ask the chatbot for that person’s address and actually get it back? In a 2022 [study](https://aclanthology.org/2022.findings-emnlp.148.pdf), GPT-Neo models given only a person’s name recovered the right email address no more than 1.24% of the time, but with the domain supplied, the rate climbed to 16.55%, and to 37.06% after five examples. Other factors, including how often an address appeared in the training data and whether surrounding email text came along with it, pushed the rate higher. Deleting chat records isn’t a remedy, either. Several state attorneys general [said](https://ag.ny.gov/press-release/2026/attorney-general-james-urges-court-protect-children-and-consumers-characterai) deleting chat records may not undo their influence on trained models. And Common Sense Media’s Robbie Torney [claimed](https://www.kqed.org/news/12104362/your-chatbot-just-went-bankrupt-what-happens-now-to-your-user-data) that exporting or deleting your data “may not mean that that data is gone from model training.” Note that people not only enter personal information about themselves during AI chats, but about their co-workers, friends, and relatives. The main thing standing between your secrets and the world is company practice. We depend on the AI companies to keep our information private. So what happens when those companies sell their assets? ## When AI bubbles burst Online chatter about the “AI bubble” bursting is pretty much constant. In China, the AI bubble has already burst, [according to Reuters](https://www.reuters.com/world/china/china-ai-bubble-has-already-burst-2026-10-26/). Over the past few months, Chinese AI stocks have been pummeled. Reuters reported that Shanghai’s STAR50 index of tech stocks fell 40% from its July high in under four months, erasing about $480 billion in market value, and that the broader CSI300 is down about 20% from its June highs. It’s not a total collapse, but it does put pressure on US stock prices and also provides an incentive to transfer ownership through sales or mergers (though this hasn’t happened in China yet). Still, the future is unknowable. Which AI companies will go bust as Character.AI did, get sold off, or get hacked? As for the chatbots themselves, their inner workings are also unknowable. That’s why we should all listen to the most paranoid amongst us, and never put sensitive information into chatbots. We just can’t trust AI to keep our secrets. --- --- title: "New Kairos DDoS Botnet Hijacks Linux Devices to Overwhelm Servers With Thousands of TCP Connections" url: "https://gbhackers.com/kairos-ddos-botnet/" lang: "en-US" type: "post" description: "Nozomi Networks Labs has documented Kairos, a previously undocumented Go-based DDoS bot for Linux. It turns compromised Linux devices into attack nodes that exhaust a victim’s connection capacity with thousands of idle TCP sessions. Kairos DDoS botnet Honeypot telemetry captured" last_modified: "2026-10-30T10:49:33+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://gbhackers.com/feed/" wpe_sourcepermalink: "https://gbhackers.com/kairos-ddos-botnet/" --- # New Kairos DDoS Botnet Hijacks Linux Devices to Overwhelm Servers With Thousands of TCP Connections Nozomi Networks Labs has documented Kairos, a previously undocumented Go-based DDoS bot for Linux. It turns compromised Linux devices into attack nodes that exhaust a victim’s connection capacity with thousands of idle TCP sessions. Kairos DDoS botnet Honeypot telemetry captured three Kairos builds. They differ only in the hard-coded C2 address and the Go compiler […] The post [New Kairos DDoS Botnet Hijacks Linux Devices to Overwhelm Servers With Thousands of TCP Connections](https://gbhackers.com/kairos-ddos-botnet/) appeared first on [GBHackers Security | #1 Globally Trusted Cyber Security News Platform](https://gbhackers.com/). ---